AI-generated websites: what you actually get.

Prompt-to-app tools now produce something that looks like a finished website in minutes, and dismissing them would be silly — we use AI heavily ourselves, including on this site. What deserves scrutiny is the gap between "looks finished" and "safe to run a business on", because independent security research published through 2025 and 2026 has now measured that gap rather than argued about it.

What the research measured

Veracode tested more than 100 large language models across Java, JavaScript, Python and C#; Java failed above 70%. The Apiiro, USENIX and Snyk figures are as compiled in the Cloud Security Alliance research note linked under Sources. Note the last row against the first: the confidence gap is arguably the finding that matters most.

What these tools genuinely do well

For validating an idea before spending real money, they are excellent and we recommend them. A clickable prototype that proves people want the thing, an internal tool three colleagues use, a one-off landing page for a campaign that ends in six weeks — the risk profile is low and the speed is unmatched. Nobody should pay an agency to find out whether an idea has legs.

They are also a legitimate first draft on real projects. A generated component skeleton that a developer then reviews, restructures and tests is faster than starting from an empty file. The distinction is not AI versus human, it is reviewed versus unreviewed.

What the code underneath tends to look like

Two patterns show up repeatedly. First, plausible insecurity: the code runs, the feature works, and the input is never validated. Cross-site scripting and injection failures dominate the Veracode results because the vulnerable version and the safe version look equally reasonable to someone who cannot read the difference — and the tool will confidently tell you it is done.

Second, authorisation that was never really implemented. Access control is the thing prompt-driven builds skip most often, because nothing visibly breaks when it is missing: the app works perfectly for the person testing it, and the database will hand any record to anyone who asks. That failure is invisible in a demo and total in production.

The costs that arrive later

Hallucinated dependencies are the underrated one. Around a fifth of generated samples import packages that do not exist, and because the invented names repeat predictably, attackers register them — so a build that worked in April can pull hostile code in July without a single line changing. Hardcoded credentials are the other recurring find, committed straight into repositories because the model needed something to put there.

Then there is the structural bill. A codebase assembled by prompting until the error stops appearing accumulates duplicated logic and no coherent architecture, which makes every subsequent change more expensive than the last. That is the point where projects stall: not at launch, but at the third feature request.

How we use AI on work we intend to keep

It writes first drafts, generates boilerplate, suggests test cases and speeds up refactoring, and every line of it is read by someone who could have written it. Inputs get validated deliberately, authorisation is designed rather than generated, dependencies are checked against the real registry, and secrets live in environment configuration and never in a commit. None of that is exotic practice — it is the practice AI-assisted output most often lacks, and it is what the 45% figure is really describing.

The uncomfortable framing is that AI raises the ceiling on how much code a good engineer ships and raises the floor on how much damage an unreviewed process does. It removes the typing, not the judgement.

What to ask before you buy an AI-built site

Five questions get you most of the way. Do you own and can you export the source code, or does it only run on the vendor's platform? Did a human review the security-relevant parts, specifically input handling and access control? Is there authentication on anything that touches customer data, enforced at the database and not just hidden in the interface? Are the dependencies real, current and patchable? And who fixes it at 9am when it breaks?

If the answer to any of those is unclear, the site is a prototype regardless of how finished it looks. That may be exactly what you need — just price and plan it as one, and get it reviewed before it holds anything you would be embarrassed to leak.

Sources

The figures above come from these published studies, checked July 2026.

• Veracode — 2025 GenAI Code Security Report ↗

  More than 100 LLMs tested across Java, JavaScript, Python and C#: 45% of generated samples introduced an OWASP Top 10 vulnerability, 2.74x the rate of human-written equivalents, with 86% and 88% failure rates on XSS and log injection. Larger models did not perform meaningfully better.

• Cloud Security Alliance — Vibe Coding's Security Debt: The AI-Generated CVE Surge ↗

  Research note compiling the Apiiro commit-and-finding data (+322% privilege escalation, +153% architectural flaws), the USENIX Security 2025 hallucinated-package finding (~20%, with 43% of invented names reproduced consistently), Snyk's developer-confidence survey and Georgia Tech's CVE attribution tracking.