AI coding assistants can draft Odoo models, wizards, controllers and XML views in seconds. That speed is real, and so is the blind spot that comes with it.
AI models learn from public code. They know the syntax and common patterns, but they don’t know your data, your company boundaries or the details of Odoo’s security model. This article is part of our Odoo security series.
Key takeaways
- AI often forgets the access rights file or wires it up wrong.
- It tends to fix permission errors by adding
.sudo()— which removes the security check entirely. - Generated controllers often get authentication wrong.
- Treat AI output as a junior developer’s draft: always reviewed, always tested as a restricted user.
The hidden risks in AI-written ERP code
- Missing security files. The Python logic and views look complete, but
ir.model.access.csvis missing or not listed in the manifest. - Privilege escalation with
.sudo(). During trial-and-error prompting, “access denied” errors get solved by appending.sudo(), which exposes administrator-level data to ordinary users. - Wrong controller authentication. Endpoints marked
auth='public'that return or change business data, available to anyone on the internet. - Outdated patterns. Code written for an older Odoo version that ignores newer security behaviour — for example the Odoo 20 move from record rules to domains on access rights.
A safe workflow for AI-assisted development
- Treat AI code as a draft. Nothing goes to staging or production without review by an experienced Odoo developer.
- Search for every
.sudo()and everyauth=in the diff, and justify each one. - Check the security files for each new model before reviewing the business logic.
- Test with restricted personas. Log in as a standard employee and as a portal user and try to see what you should not.
- Run automated checks — linters and tests in your CI pipeline — so obvious problems are caught before review.
- Don’t paste secrets or customer data into prompts. Use sample data when you ask an assistant for help.
The OWASP Top 10 is a useful checklist for reviewers, and our complete guide to Odoo AI covers where AI adds the most value inside Odoo itself.
How Mediod can help
Mediod helps teams set up a safe AI-assisted development workflow: review checklists, CI checks and expert code reviews by our Odoo developers. Your team keeps the speed, and the code stays safe. Earlier in this series: custom module security debt.
More from our Odoo security series
- Custom Modules and Security Debt: Writing Safe Odoo Apps from Scratch
- Hardening a Dedicated Odoo Server (VPS or On-Premise): An Infrastructure Blueprint
- Odoo.sh Security: What’s Handled for You and What You Still Need to Protect
See all Odoo Security articles →
Want a second pair of eyes on your Odoo security?
Mediod Consulting is an Official Odoo Partner. We review custom modules, access rights, integrations and hosting set-ups, and give you a prioritised list of fixes. Book a free discovery call or request a quotation for a security review.
Frequently Asked Questions
Is AI-generated Odoo code safe to use?
It can be, after review. AI often misses access rights, overuses sudo() and misconfigures controller authentication, so every change needs a human code review and testing as a restricted user.
Why is sudo() dangerous in Odoo?
sudo() runs code as the superuser and skips access rights. If its results reach the user, they can see or change records they should never have access to.
