Theregister AI Code Tools Linked to Increased Vulnerabilities in Software
Article Content
- •Georgia Tech researchers linked 74 CVEs to AI-generated code, with 35 identified in March 2026.
- •Claude Code authored 27 of the 35 new CVEs, reflecting its growing use in public repositories.
- •Detection limitations may mean the actual number of vulnerabilities is significantly higher.
Researchers from Georgia Tech SSLab have identified a significant rise in vulnerabilities linked to AI-generated code. In March 2026, they reported 35 new CVEs, with 27 attributed to Claude Code, a popular AI coding tool. This follows a previous finding in August 2025, where only two CVEs were linked to Claude Code. The total number of CVEs attributable to AI-generated code now stands at 74 out of 43,849 advisories analyzed. The researchers caution that the actual number of vulnerabilities could be much higher due to detection limitations. They emphasize that the low number of confirmed AI-related vulnerabilities does not imply that AI-generated code is more secure than human-written code. The findings align with earlier research from Georgetown University, which indicated that nearly half of AI-generated code snippets contained bugs. The ongoing analysis highlights the need for caution when using AI tools in coding practices.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track CVE-2025-55526 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host… 
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…