MR-019 Model & system behaviour System scope

Insecure or vulnerable code generation

The system generates code containing security vulnerabilities that propagate into production software.

Risk family: Model & system behaviour
MIT domain: 2. Privacy & Security
MIT subdomain: 2.2 > AI system security vulnerabilities and attacks
AI type: GPAI, Agentic
Scope: System
Source standard: MIT AI Risk Repository v4

Provenance

Source standard

MIT AI Risk Repository v4

MIT source entries

Cui2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systems02.03.04
Gipiškis2024Risk Sources and Risk Management Measures in Support of Standards for General-Purpose AI Systems62.16.07
IBM2025AI Risk Atlas65.15.02

Ev IDs of the entries consolidated into this risk in the MIT AI Risk Repository (V4); the source sheet row appears on hover.

ISO/IEC references

23894 obj A.11; src 7; mech B.5 | 42001 ctrl A.6.2.4

Framework crosswalk

Every framework item mapped to this risk. Items marked partial overlap only in part; definitions appear on hover where the source licence permits.

Sourcesframeworks that contributed to the register

A.11 ISO/IEC 23894 Annex A A.11

A.6.2.4 ISO/IEC 42001 Annex A A.6.2.4

Cross-checksframeworks mapped in to test coverage

ibm-harmful-code-generation Harmful code generation

AISubtech-12.2.1 Code Detection / Malicious Code Output

More in Model & system behaviour

MR-001 MR-002 MR-003 MR-004 MR-005 MR-006 MR-007 MR-008 MR-021 MR-022 MR-023 MR-025 MR-026 MR-027 MR-028 MR-029 MR-031 MR-049 MR-050 MR-051 MR-052 MR-053 MR-055 MR-056 MR-057 MR-058 MR-059 MR-061

See all Model & system behaviour risks →

Part of the Deployer AI Risk Register, an open-source resource powered by MindXO. Version 1.0, 3 July 2026. Derived from the MIT AI Risk Repository (V4, December 2025) under CC BY 4.0; an independent derivative work, not endorsed by or affiliated with MIT. Sub-risk decomposition references MITRE ATLAS™ v5.6.0 (© 2021-2026 The MITRE Corporation, reproduced and distributed with permission). ISO/IEC and EU AI Act references are by number only. License: CC BY 4.0. Full attribution and licensing.