Privacy International tested four real applications built with popular AI coding assistants and found the tools routinely shipped broken encryption, unencrypted messages, missing password salts, and hardcoded values standing in for features that never actually worked. Researchers Rose Willis and Kathryn Conrad ran the experiment specifically to see what an ordinary developer, not a security expert, would end up shipping by trusting the tool’s output.

Why the errors are invisible

The reason this matters is not that AI tools write bad code sometimes, every tool does that. It is that these particular failures are structural: encryption that looks implemented but isn’t, and test data quietly substituted for logic that was never finished, are exactly the kind of defects a non-expert cannot audit by reading the output. The code runs, the app appears to work, and the privacy failure sits invisible until something exposes it.

Who actually carries the risk

This lands hardest on the people least equipped to catch it: small teams, solo builders, and non-technical founders who reach for an AI assistant precisely because they don’t have a security engineer on staff. Privacy International’s point is not that the tools should be banned, but that trust in AI-generated code is currently running ahead of anyone’s ability to verify it, especially for applications handling health records, financial data, or anything else sensitive.

WikiActivism’s view

A tool that makes writing an app easier without making it easier to know whether that app is safe has quietly shifted risk downward, onto users who never chose to accept it and have no way to know it exists. The fix is not to distrust AI coding tools wholesale, it’s independent audit before anything handling real personal data ships, the same standard that should have applied before AI made writing the code this fast.

Source: Privacy International, “Bad Vibes: AI coding tools and privacy issues”, June 9, 2026.