What are common vulnerabilities in ChatGPT code?

The most frequent vulnerabilities in ChatGPT-generated code include SQL injection from string-concatenated queries, cross-site scripting from unsanitized output rendering, hardcoded API keys and credentials, missing CSRF protection, insecure direct object references, and broken access control logic. ChatGPT also tends to generate overly permissive CORS configurations, skip rate limiting on sensitive endpoints, and use outdated or deprecated libraries with known CVEs. Error handling is often incomplete, potentially leaking stack traces and internal paths to attackers. UNPWNED detects these common AI-generated vulnerabilities through its automated scanning of 700+ security checks across 40 scanners.