Adventures in AI Security : Claude (Part 2)
Following up on my previous story, I wanted to implement a fully secured api backend with:
- authorization/authentication
- RBAC/ABAC
- session management
Most AI generated code only focuses on authentication/authorization and skips all other security. This is mainly due to the fact that the models it is trained mainly implements JWT tokens and nothing else.
So we thought we would try to see if AI can handle writing security.
Tools
Again, we are still using Java and Springboot due to their robust and mature securty tools and libraries.
Authorization/Authentication (Score: A)
Claude did great at adding this functionality with a filter and then adding an endpoint for ‘login’.
This is 100% expected because the vast majority of models it is trained on implements this functionality.
RBAC/ABAC (Score: D)
Claude was able to implement RBAC ok but when asking it to implement ABAC for the request/response, it hardcoded functionality into the endpoint as a one-off; in other words, it did not implement the functionality in a re-usable way.
Get API Expert’s stories in your inbox
Join Medium for free to get updates from this writer.
It also took 3–4 iterations to get this even semi-correct.
This code was overly complex and not reusable. It ALSO did not implement ABAC for the RESPONSE dataset per ROLE so was only a partial implementation.
Additionally, it added endpoints that I did not ask for and even wiped out previous endpoints that I HAD asked for. I had to do a reversion in order to get the original endpoints back.
Session Management (Score: F)
This is where it completely failed. Claude could not associate the JWT with the session and had a nervous breakdown trying over and over to implement this.
Conclusion
As we added more and more security to the code, Claude got worse and worse. This is consistent behaviour we have witnessed in Claude as well as other models.
- JWT (complete) : 1 iteration
- RBAC (complete): 2–3 iterations
- ABAC (partial) : 3–4 iterations
- Session management (incomplete): 6 iterations
Most AI can only do the basics and the more complexity you add, the more mistakes it starts making.
This is a common issue with AI in that the more complexity added, the more mistakes it starts to make.
I have tested this by switching some of the functionality and it seems the first 1–2 items added can be accomplished for the most part but trying to accomplish a completely secure application is impossible.
This seems to be an inherent scalability issue with AI and something that cannot be fixed with existing models.
