Topic starter
18/08/2026 2:42 pm
TL;DR: AI coding assistants are now used or planned by 84% of developers, while research cited by Kusari shows the output often carries more security flaws, hallucinated dependencies, and missing defensive controls than human-written code. The governance problem is no longer adoption itself, but the lack of workflow controls that treat AI-generated code as untrusted input.
Editorial analysis by NHI Mgmt Group, based on content published by Kusari: “AI Coding Assistants in 2026: 4Ã Faster, 10Ã Riskier and The Hidden Security Cost”.
By the numbers:
- 84% of developers now use or plan to use AI coding assistants, according to Stack Overflow's 2025 Developer Survey cited by Kusari.
- 51% of professional developers rely on AI coding assistants daily, according to Stack Overflow's 2025 Developer Survey cited by Kusari.
- GitGuardian found that 6.4% of repositories using GitHub Copilot leak at least one secret, compared with a 4.6% baseline in repositories without AI assistance, according to Kusari.
Key questions
Q: What is the failure mode when AI coding agents generate code without security guardrails?
A: The failure mode is insecure code becoming the default implementation path before anyone applies review or remediation.
Q: Why do AI coding agents increase supply-chain risk?
A: AI coding agents can choose tooling, install packages, and edit lock files in ways that may bypass the controls humans expect in a managed environment.
Q: What do security teams get wrong about AI-generated code risk?
A: They often focus on catching insecure output after code is written, which is too late for AI-native workflows.
Practitioner guidance
- Treat AI-generated code as untrusted input Require developers and reviewers to assume AI-authored snippets may contain insecure logic, missing validation, or unsafe dependency references before they are merged.
- Enforce PR-gated SAST and SCA Run static analysis and transitive dependency checks inside the pull request so insecure patterns and inherited package risk are caught before code reaches mainline.
- Verify all suggested packages against registries Block nonexistent, newly registered, and typosquatted package names that appear in AI output, and require provenance checks for any package the model proposes.
Bottom line: AI coding assistants are now embedded in mainstream development, but they also widen the gap between delivery speed and application security coverage.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:26 pm
AI coding assistants have shifted the AppSec problem from isolated coding mistakes to systemic workflow risk. The central issue is not whether developers can produce code faster, but whether the surrounding controls can still verify what that code contains. Once AI output becomes a default input to the SDLC, review discipline has to move from manual inspection to enforced security gates.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
A: Teams should treat AI-assisted development as a throughput shift, not just a productivity gain. The SDLC needs more automation in testing, CI/CD, release orchestration, and policy enforcement so higher code volume does not create bottlenecks. Governance should be embedded early, with standardized workflows and risk controls that keep quality and security aligned as delivery speed rises.
👉 Read our full editorial: AI coding assistants widen appsec gaps across code and supply chain