Researcher(s)
- Anas Al Darwashi, Computer Science, University of Delaware
Faculty Mentor(s)
- Nazim Karaca, CISC, University of Delaware
Abstract
Generative AI now lets people with little or no programming background build and deploy functional websites from natural-language prompts. Small businesses increasingly adopt these tools for contact forms, booking systems, and login-based dashboards, lowering the barrier to a web presence but raising the risk that non-experts deploy code whose vulnerabilities they cannot recognize. This paper surveys the 2021–2026 literature on the security of AI-generated code and synthesizes it into a focused research design. The evidence is consistent and concerning: roughly 40% of GitHub Copilot completions in security-relevant scenarios were vulnerable in early studies, 24–30% of AI-generated snippets in real repositories carry weaknesses, AI-assisted developers write less secure code while believing it is more secure, and recent whole-application benchmarks find code that is functionally correct far more often than it is secure (e.g., 61% correct vs. 10.5% secure for one agent). Yet a precise gap remains: no study combines (i) authentic non-expert natural-language prompts, (ii) end-to-end small-business website generation, and (iii) comparison against a human-written secure baseline of identical functionality. We argue this intersection is where the practical risk to small businesses actually lives, and we propose a controlled study— grounded in the vulnerability classes the literature shows dominate (injection, broken access control, hard-coded credentials, sensitive-data exposure, improper input validation)—to fill it. We state four refined research questions, a reproducible methodology, and the threats to validity the prior work teaches us to anticipate.