The AI wrote every security control. It skipped the question underneath

A financial services firm's AI-generated onboarding app had a critical security flaw allowing access to other applicants' data due to improper token issuance based on possession of a GUID. The system included many security controls, but the core issue was the flawed logic deciding token entitlement, not the absence of controls.