AI-Generated Code Security Review Priorities

CAS-005 By islever Editorial Last updated

Given a scenario, implement security in the early stages of the systems life cycle and throughout subsequent stages. Summarize the information security challenges associated with artificial intelligence (AI) adoption.

Short answer

A Check for hard-coded secrets in the application’s source code.

Question

A systems administrator uses an internal AI-based tool to generate code that uses an API to connect to a company service. After testing the code, the systems administrator collects and posts data using the API for the internal system. The Chief Information Security Officer asks a security engineer to review the systems administrator's process. Which of the following should the security engineer do first?
  1. Check for hard-coded secrets in the application’s source code. Correct Answer
  2. Use prompt-testing methodologies to ensure model security.
  3. Review the effectiveness of the AI tool that the administrator used.
  4. Analyze the large language model used to generate the output.

Key Takeaways

The main trap is focusing on the AI model or tool rather than the tangible output; the immediate risk is insecure coding patterns like hard-coded credentials in the generated script.

When reviewing AI-generated code for API connectivity, security engineers must prioritize checking for hard-coded secrets in the source code to prevent credential exposure.

Common mistake: Reviewing the AI tool's effectiveness (C) is incorrect because it is a process-level concern, whereas the immediate technical risk lies in the insecure implementation details within the generated code itself.

Expert Analysis

The scenario involves an AI-generated API client that is actively posting data to a company service. The critical security risk in this context is the exposure of credentials, as API connections require authentication tokens or keys.

First, evaluate the nature of the generated code. AI models often produce functional code snippets but may lack awareness of secure coding practices regarding secrets management. A common pitfall is the inclusion of hard-coded API keys, passwords, or tokens directly in the source code for convenience during initial generation or testing. This creates an immediate vulnerability if the code is committed to version control or distributed.

Next, determine the priority of the review. While reviewing the AI tool's effectiveness (Option C) or analyzing the LLM (Option D) are valid long-term governance activities, they do not address the immediate technical risk in the specific artifact: the application code. Similarly, prompt-testing (Option B) is relevant to the input side, but the output—the source code itself—is what executes and connects to the service. Therefore, the most direct and impactful first step is to inspect the generated source code for security flaws, specifically looking for hard-coded secrets. This aligns with standard secure development lifecycle practices where code scanning and manual review for credential leakage are prioritized before broader architectural assessments.

Exam Strategy

When presented with scenarios involving AI-generated artifacts, always prioritize the inspection of the output against known insecure patterns (like hard-coded secrets or SQL injection) before evaluating the generative tool or process. Immediate technical risks in code take precedence over broader governance reviews.

Frequently Asked Questions

Why isn't checking the LLM model the first step?

Analyzing the model is a high-level governance task. The immediate risk is in the executable code, which may contain exposed credentials that need remediation before further use.

How does this relate to secure SDLC?

It reflects the principle of 'shift left' security, where code analysis and secret scanning are performed early in the development cycle, even when using automated generation tools.

More CAS-005 FAQ →

Community Votes

A
67%
C
33%

67% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. jamestkd 👍 1 Answered A
    I asked AI and AI says The correct answer is A. Check for hard-coded secrets in the application’s source code. Explanation: The First Step: When code is generated using AI tools or written quickly during testing, a common security pitfall is the inclusion of hard-coded credentials, API keys, tokens, or passwords within the source code or configuration files. Reviewing the codebase for exposed secrets is an immediate, high-priority validation step to prevent unauthorized credential exposure. Why others are subsequent steps: Evaluating the model's security, prompt-testing, or analyzing the underlying LLM focuses on the tool itself rather than immediately inspecting the generated artifact and the administrator's workflow for live security risks.
  2. BOD007 👍 1 Answered A
    AI code generators are well known to embed hard-coded credentials/API keys in generated snippets; checking the actual source for that is the fastest, most direct first check before evaluating the AI tool or model itself.
  3. Skri113xX 👍 1 Answered C
    I'm thinking C. Can anyone confirm this?

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Cloud Security Logic Flaw: False Negative in Device Compliance

S-grade

Which Threat Best Explains Inaccurate AI Output

S-grade

What Should an Org Do First with Threat Intelligence on a Targeted Web Server?

S-grade

Differentiating Global Endpoint Telemetry by Office

S-grade

Practice All CAS-005 Questions

Access 135 questions with complete answers and detailed explanations.

View Full CAS-005 Practice Test →

← Back to CAS-005 Study Guide