The OWASP Top 10 (2025) for AI-generated code: what to check in every pull request
Summary
The OWASP Top 10 got its first update in four years. Broken access control is still number one, security misconfiguration jumped to two, and software supply chain failures made the top three.
Two categories are brand new, and SSRF lost its own spot and got folded into access control.
Every category applies to code written by AI agents. But three of them are the ones we see slip through review most: broken access control, insecure design and supply chain failures.
They're the flaws that compile, pass the tests and look fine in a diff. This post walks the list with that lens, so you know what to look for in an agent's pull request.
Those flaws are reaching real software. A 2026 study of 302,600 AI-authored commits across 6,299 GitHub repos found AI introduced about 1.5 times as many security issues as it fixed, and Georgia Tech's Vibe Security Radar had traced 74 CVEs to AI coding tools by the end of March 2026.
What changed from 2021
OWASP added Software Supply Chain Failures and Mishandling of Exceptional Conditions. SSRF moved into Broken Access Control.
Security Misconfiguration climbed from fifth to second, while Cryptographic Failures, Injection and Insecure Design each slid down a couple of spots. In total the list now maps 248 CWEs.
There's still nothing AI-specific in it. Prompt injection and friends live in OWASP's separate Top 10 for LLM Applications.
The list, as agents write it
The three that get through
Broken access control is the one to obsess over. An agent writing a new endpoint sees the file in front of it, not the ownership rules spread across your codebase, so it checks the caller is signed in and stops there.
Change the ID in the URL and you're reading another customer's data. We wrote a whole post on IDOR and its relatives.
Insecure design is harder still, because the code does exactly what it says. It just lets someone skip a step they shouldn't. There's no bad pattern for a scanner to match.
Supply chain failures come from agents being helpful. They install whatever solves the problem in front of them, each package brings its own dependencies, and nobody chose any of them on purpose.
A version that was fine last month can have a CVE tomorrow.
And attackers move fast once one does. In Verizon's 2026 Data Breach Investigations Report, exploiting a vulnerability was how 31% of breaches started, up from 20% the year before.
Using the list at agent volume
OWASP is clear that the Top 10 is an awareness document, not a checklist. Still, it's a decent way to make sure your PR reviews aren't only catching injection.
A few things help once agents are writing most of the code. Review every pull request against all ten, not just the PRs that look risky, because agents opened more than 40% of GitHub pull requests in September and gut feel doesn't scale.
Make sure the reviewer, human or not, understands how your codebase is meant to behave, since A01, A06 and A08 are invisible from a diff alone.
And when review catches something, turn it into guidance your agents follow so it isn't written again next week.
How Dam Secure covers it
This week on acme/platform
Every Dam Secure PR Security Review and full codebase review runs nine security lenses: access control, injection, secrets, authentication, SSRF, cryptography, AI and agents, supply chain, and misconfiguration.
Each finding gets checked for reachability and existing mitigations first, so developers see fewer than five findings per PR instead of 15 or more.
Because Dam Secure maps how your codebase fits together at onboarding, it catches the A01 and A06 flaws pattern matching can't.
Code findings, secrets and vulnerable dependencies all land in one backlog with every fix and dismissal recorded, which comes in handy when a customer security questionnaire asks how you handle the OWASP Top 10.
"Security PR reviews are critical for a scaling unicorn like Serval. General AI coding tools lack deep security codebase context and can't learn from their mistakes. Dam Secure does all of that out of the box." Sam "Frenchie" Stewart, Head of Security, Serval
FAQ
What are the new categories in the OWASP Top 10 2025?
Software Supply Chain Failures (A03) and Mishandling of Exceptional Conditions (A10).
Where did SSRF go?
It's part of A01 Broken Access Control now.
Does the OWASP Top 10 cover AI risks?
Not directly. OWASP covers prompt injection and other model risks in its Top 10 for LLM Applications. The main Top 10 still applies fully to code that AI writes.
Want OWASP Top 10 coverage on every pull request? Speak to our team.
.webp)