A penetration test at a financial services firm managing billions of dollars in client assets has found a critical flaw in AI-generated code. The interesting part is what the code got right.

Sygnia, the incident response firm, assessed a customer onboarding application built substantially with Claude. It handled government-issued identification, identity verification data, payment details and Social Security numbers.

The flaw let one applicant reach another applicant’s record.

What actually broke

The application solved a real problem. People start an application, leave, and return before they have an account, so the system must restore their progress without a password.

Claude produced a temporary access model for that. The flaw sat in how the model decided who deserved a token.

Possession of an applicant’s globally unique identifier, or GUID, counted as sufficient proof to issue or restore an access token for that applicant.

“In effect, the GUID became a bearer secret,” Sygnia wrote in its research.

A GUID identifies a record. It does not prove that whoever holds it controls the session, the device, the identity or the verified contact channel attached to it.

Anyone with another applicant’s GUID could reach names, contact details, application status, financial details, identity verification data, payment information, Social Security numbers and co-applicant records.

Co-applicants deserve a pause. Those are people whose data sat in the system because somebody else named them.

The controls were all there

Here is what makes the finding unusual, and it is not the story most AI coding failures tell.

The implementation did not lack security. Sygnia describes a plan covering temporary tokens, expiration, rate limiting, audit logging, session restoration and suspicious-activity detection.

Every one of those is a real control. None of them answers the question the system actually needed to answer.

“What must be proven before the backend issues or restores an applicant access token?” the researchers ask.

The vulnerability existed before issuance, at the moment the system decided whether the requester deserved a token at all.

“The issue was not that the system lacked security controls,” Sygnia wrote. “The issue was that the controls were wrapped around the wrong trust decision.”

A short-lived token still causes damage when it reaches the wrong person. Audit logs help an investigation afterwards and prevent nothing.

Why the scanners miss this

Static application security testing tools hunt for insecure coding patterns and unsafe data flows. This was neither.

The flaw was architectural. It lived inside an assumption about trust, written in code that followed familiar framework conventions and passed basic checks.

“Working code is not the same as secure code,” said Zach Mead, the Sygnia penetration tester who ran the assessment.

“AI-generated code may compile, follow familiar conventions, and pass basic checks, while still making flawed assumptions about trust boundaries, authorization, state, ownership, or third-party integrations,” he said.

His instruction to security teams is blunt. Treat AI-generated output as untrusted until validated.

An LLM found what an LLM built

Sygnia did not catch this by hand. It ran a language model across portions of the client codebase, looking for trust-boundary problems and business-logic flaws.

The model surfaced the applicant-token issue directly.

Sygnia’s summary of that is the sharpest line in the research. A vibe-coded security architecture flaw was identified through vibe-coded code review.

It cuts both ways, and the firm says so. If a defender can ask a model where the trust boundaries are missing, so can anyone holding leaked source code or stolen implementation notes.

Cisco has been pointing open-weight models at bug hunting for the same reason. One capability, two uses.

The tempo problem

This research sits beside a second Sygnia case, and the pairing carries the argument.

In a cloud intrusion the firm investigated, the first signal was not an exploit. It was the pace.

Credential discovery, cloud enumeration, source-code review, CI/CD probing, database access and operational disruption all ran at once. It resembled several operators rather than one.

It was one person, working with agents.

Put the cases together and the shape is clear. AI is accelerating how code gets written, how flaws get found, and how fast a weakness becomes an attack path. We have already tracked four separate attacks sharing a single underlying flaw.

What Sygnia tells clients to do

Not to ban the tools. Bans push usage into personal accounts, where nobody can see it.

The firm suggests marking pull requests that AI generated or substantially modified, naming the tool, and flagging work that touches authentication, payments, data exports or regulated client information.

The most concrete advice concerns prompts. Asking for “temporary access tokens for applicants” is an incomplete instruction.

A safer prompt states that applicant identifiers must not be treated as secrets, that token issuance requires independent proof of applicant control, and that negative tests must prove one applicant cannot obtain access for another.

The security requirement has to sit in the prompt, because the model will not infer an institution’s risk model on its own.

One caveat worth stating

This is a vendor report about an unnamed client, published alongside a new commercial service.

Sygnia launched AI Cybersecurity Services the same day, covering posture assessment, governance and AI application penetration testing. Nobody can independently verify the findings, and no other firm has reported this case.

The mechanism it describes is checkable, though, and it echoes our earlier coverage of vibe-coding security failures, sandbox escapes in coding agents and prompt injection in a Claude Code GitHub Action.

What separates this one is where the flaw sat. Those were vulnerabilities in the tooling. This was AI-generated code carrying the flaw into production, at a regulated business, around data customers are required to hand over.

Get the TNW newsletter

Get the most important tech news in your inbox each week.