AI-Created Cloud Code Has 4x More Security Risks Than Human Code
Your company's AI could accidentally leave the digital door unlocked.
Researchers wanted to know if AI-written infrastructure-as-code (the instructions that set up cloud servers and databases) is more dangerous than code written by human engineers. They created 100 realistic deployment scenarios, asked 12 AI models to write the code, and scanned everything for security vulnerabilities——like exposed passwords, open ports, or weak encryption. They also scanned 634 human-written templates with the same tools, making this the first apples-to-apples comparison with a real human baseline.
The results are sobering. AI-generated code had 3.21 to 3.87 times more vulnerabilities per resource than human code. The gap was widest for simple tasks: AI was 4.9 times worse when setting up just one component, and only 1.4 times worse for twenty or more components. This suggests AI models are relatively weakest on the easy, routine stuff that human engineers have seen many times before.
The researchers also tested whether AI's "extended thinking" mode (where the model reasons longer before answering) improved security. It did help a little——cutting vulnerabilities by 12% compared to regular prompting——but it still didn't come close to beating human engineers. A surprising side finding: whether the AI code actually ran or deployed successfully had zero correlation with how secure it was. In other words, perfectly functional AI-generated code can still be riddled with holes.
What does this mean for you? If your company is using AI to write cloud configuration files, these findings are a warning. AI can speed up infrastructure work dramatically, but the results clearly show that human review is still essential——especially for simpler, repetitive tasks where AI seems to get complacent. The good news is the researchers released all their code and data, so other teams can now test their own workflows. Until AI closes this gap, treat AI-generated infrastructure like a draft from a junior developer: useful, but never deploy without a security check.
- AI-made cloud code had roughly 4x more security holes than human code — and 5x more for simple setups.
- Even premium 'extended thinking' AI modes only cut flaws by 12%, still worse than humans.
- A working AI-generated setup doesn't mean it's safe: security and deployability had no link.
Why It Matters
If your company uses AI for cloud setup, these flaws could expose customer data.