Issue 13 — Three $100M+ breaches by 2028 — the patterns are already on my scanner

Thirty-five point two seconds. That is how long it took the V5 vibe code quality scanner to find 406 findings in its own AI-generated codebase. Seventy-five of those were security issues. Hardcoded secrets. Missing input validation. Over-permissive CORS. The grade: D.

This was not a scan of someone else’s code. This was my own codebase — built by a security-conscious practitioner using the best available AI tools. If my code scores a D on my own scanner, what is the rest of the industry shipping?

That is the question behind PRED-013. And it is the highest-confidence prediction in the book.

PRED-013 — By December 2028, AI-generated code will cause at least three major security breaches, each exceeding $100 million in direct financial damages (settlements, fines, remediation, lost revenue). Common patterns: hardcoded secrets, missing input validation, phantom dependencies, over-permissive CORS, unsafe deserialisation. At least one regulatory body will issue formal guidance addressing AI-generated code risks.

Confidence: 5 out of 5.

The chapter makes the structural case. Forty-six percent of code on GitHub is AI-generated. Most of it ships without AI-specific security scanning. OWASP has no dedicated AI-generated code vulnerability taxonomy. Every major technology shift — cloud, mobile, IoT — produced security crises within two to three years of mass adoption. AI-generated code reached mass adoption in 2024–2025. The clock is running.

What the chapter does not do is name the specific patterns by prevalence. This issue does.

The V4 security scanner and V5 vibe code quality scanner — two of the agent businesses I run — have scanned AI-generated codebases across my ventures and across early-access client deployments. The SEC-AI-001 through SEC-AI-010 vulnerability taxonomy documents the repeatable anti-patterns that AI models generate consistently. Three patterns dominate by prevalence.

Hardcoded secrets. API keys, database credentials, and authentication tokens embedded directly in source code. AI models generate functional code — and functional code that authenticates against a service often includes the credential inline. The model optimises for “this works” not “this is safe.” In V4/V5 scan data, hardcoded secrets are the single most frequent security finding across AI-generated codebases. They are also the easiest to exploit: a single leaked key in a public repository gives an attacker production access.

Phantom dependencies. Package names that do not exist in any public registry but are hallucinated by the model. An attacker registers the phantom package name, publishes a malicious version, and waits for the next npm install or pip install to pull it in. The supply-chain attack surface is created by the model itself. V4/V5 scans flag phantom dependencies as a distinct category because traditional SAST tools do not check whether a dependency actually exists — they only check whether it has known vulnerabilities.

Over-permissive CORS. AI-generated backend code frequently sets Access-Control-Allow-Origin: * because it makes the development environment work immediately. In production, this allows any domain to make authenticated requests to the API. The model generates the permissive configuration because it reduces friction during development. The developer ships it because they trust the model’s output. The breach happens six months later when an attacker’s domain makes a credentialed request the server was never designed to accept.

These are not random bugs. They are systematic. The models generate them because the training data contains them and because the optimisation target — “produce code that runs” — does not penalise insecure code that runs. The pattern will not self-correct through model improvement alone. It requires a separate scanning layer, applied after generation and before deployment. That layer barely exists today.

The attack surface is massive. Forty-six percent of GitHub code is AI-generated, and growing. The defences — AI-specific SAST, phantom-dependency detection, hardcoded-secret scanning applied at the generation boundary — are nascent. The gap between attack surface and defence surface is the widest it has been for any technology shift since cloud adoption in 2008–2012. Three breaches exceeding $100 million each by December 2028 is not a stretch. It is the base case.

The published falsification trigger:

If by December 2028, fewer than two breaches are publicly attributed to AI-generated code, or if no regulatory body addresses AI code quality in any formal guidance, this prediction is wrong.

The realistic failure mode is not that the vulnerabilities disappear. It is that the attribution never happens. A breach caused by a hardcoded secret in AI-generated code may be reported as “a credential management failure” without anyone tracing it back to the generation method. If the industry does not build attribution tooling — if no one can prove after the fact that the vulnerable code was AI-generated — the breaches happen but the prediction becomes unfalsifiable. The same definitional risk that threatens PRED-001 threatens PRED-013, from the other direction.

Run one check tonight. Pick one of the three patterns — hardcoded secrets, phantom dependencies, or over-permissive CORS — and grep your own AI-generated codebase. Not your entire codebase. The code your AI tools generated in the last 90 days.

For hardcoded secrets: grep -rn "api_key\|apiKey\|secret\|password\|token" --include="*.ts" --include="*.py" --include="*.js" src/

For phantom dependencies: check whether every package in your package.json or requirements.txt actually exists in the public registry. One npm view <package-name> or pip index versions <package-name> per line.

For CORS: grep -rn "Access-Control-Allow-Origin" --include="*.ts" --include="*.py" --include="*.js" src/

Reply with the hit count — anonymised, no code required. I will publish a distribution on the public PRED-013 tracking page at atin-agarwal.com/predictions/pred-013-ai-code-breaches/, updated as data comes in. If fewer than 30% of respondents find at least one of the three patterns, the “conditions already in place” thesis weakens. I doubt that will happen.

If you are an engineer: run the three greps today. The output is the answer to whether PRED-013 is your problem. If you find even one hardcoded secret in production AI-generated code, you have a live vulnerability. Fix it before you finish reading this paragraph.

If you are a security leader: this is the 2026–2027 vulnerability taxonomy your SAST vendor does not cover yet. The SEC-AI patterns — hardcoded secrets, phantom dependencies, over-permissive CORS, unsafe deserialisation, missing input validation — are systematic and repeatable. Ask your vendor whether they scan for AI-specific anti-patterns. If the answer is “our existing rules cover that,” push back. They do not.

If you are a founder shipping AI-generated code: a breach attributed to your AI code in 2027 is a board-reportable event. The audit cost is a fraction of the remediation cost. Budget for the audit now — not after the first breach makes the news.

This issue is drawn from Chapter 9 of The AI Agent Economy — 15 falsifiable predictions with dates, numbers, and explicit triggers for being proven wrong. Read it on Kindle — $9.99. atin-agarwal.com/books

Read the full PRED-013 entry on the public tracking page → atin-agarwal.com/predictions/pred-013-ai-code-breaches/

Previous issue: Issue 12 — The founder archetype behind India’s next 8 unicorns is already in the room → agarwalatin.substack.com/p/issue-12-the-founder-archetype-behind