AI Coding Assistants Often Create Insecure Servers — Here's How To Fix It

AI coding assistants are great at writing code fast, but what if that code is insecure? That's the question a new study asked about a specific type of code called Ansible, which is used to configure servers automatically. Think of Ansible as a recipe that tells a computer exactly how to set up a server — which software to install, which ports to open, and how to handle passwords. If that recipe is sloppy, your server becomes an easy target for hackers.

Researchers tested 16 popular AI models, asking each to generate Ansible code for two common programs: Apache Tomcat and MongoDB. They then checked the code against CIS benchmarks, which are essentially industry-standard security checklists. The result? Every single model produced code with security flaws — things like leaving default passwords or exposing sensitive data. The AI-generated code was also worse than what human developers typically write, which was a surprise given how confident these tools can be.

The big fix, the team found, wasn't to retrain the AI. Instead, they used a clever prompt formula called CO-STAR, which adds precise security rules and best practices to the request. When they did this, some models drastically improved. The best one hit 95-100% compliance — quadrupling the human baseline of 23-43%. But here's the catch: 12 of the 16 models still failed, not because they couldn't code, but because they couldn't juggle multiple instructions at once.

So what does this mean for you? If you're a developer, tech manager, or just someone who uses AI to automate tech tasks, this is a warning. AI can be a powerful assistant, but it needs clear guardrails. For businesses, the lesson is simple: never deploy AI-generated infrastructure code without a security review. The good news is that simple prompt tweaks can make capable models much safer — no engineering degree required.