I think we'll pretty quickly see a best practice emerging that any generated code will be subject to an additional pass scanning for vulnerabilities. The scan will be done by a different model than the one that created the code. That will help catch vulnerabilities created by models, whether intentional or not.

This should be done regardless of which model was used - American or otherwise.