Assessing the Impact of AI Coding Agents on Security Vulnerabilities in Web Development: An Analysis of Emerging Software Engineering Practices in Zimbabwe

This study examined whether web application code produced by two AI coding agents, ChatGPT (GPT-4) and GitHub Copilot, contains more security weaknesses than human-written code implementing the same task, and how Zimbabwean web developers use and verify these tools. Thirty common web development tasks covering authentication, database CRUD, form processing, and REST APIs in Python (Flask) and Node.js (Express) were each implemented once by an AI agent from a standardized prompt and paired with a human-written implementation of the same task drawn from a separate public GitHub repository. All 60 implementations were scanned with SonarQube findings were deduplicated and manually verified; and Security Hotspots reported separately as items requiring review. AI implementations contained 11 security issues in 11 of 30 samples, compared with 7 issues in 6 of 30 human implementations; within pairs, the AI version had more issues in 6 tasks, fewer in 2, and the same number in 22. The difference was not statistically significant (exact sign-test p = 0.289; McNemar p = 0.13). Hardcoded secrets and binding to all network interfaces were the most common issues in both groups, and SonarQube flagged Flask debug mode in all 16 Python AI implementations compared with 6 of 16 human ones. A survey of 54 developers recruited through Zimbabwean developer networks found universal AI tool use but infrequent security review of AI-generated code. The results do not show that AI agents produce markedly less secure code than the human examples, but they show that both reproduce insecure configuration defaults that routine review and scanning could catch. Keywords - AI coding agents: ChatGPT: GitHub Copilot: OWASP Top 10: Secure software development: Static application security testing: Web application security: Zimbabwe