How AI Code Generators Inherited a 2013 Security Vulnerability

Major AI code assistants including Cursor, Claude Code, and Copilot generate JavaScript with a prototype pollution vulnerability (CWE-1321) because their training data reflects pre-2019 security practices. Attackers can exploit the vulnerable for...in merge pattern to inject malicious properties across an entire Node.js application, compromising authentication and audit systems. The one-line fix using Object.hasOwn() is simple, but AI models don't apply it without explicit security context.