Notifications
Clear all
Topic starter
01/08/2026 10:45 pm
TL;DR: AI-generated code is accelerating vulnerability discovery and exploit generation faster than many teams can patch, while AI agents can trigger destructive outcomes in seconds, according to Checkmarx and Gartner. The governance shift is clear: AppSec can no longer stop at detection, because speed, exploitability, and runtime control now determine exposure.
NHIMG editorial — based on content published by Checkmarx: analysis of AI-generated code, Mythos, and agentic security in application security
By the numbers:
- Of the vulnerabilities Mythos has found so far, 99% haven’t been patched, according to Gartner.
- The cost of fixing a vulnerability rises roughly 10x at every stage you wait.
Questions worth separating out
Q: How should security teams govern AI agents that choose tools at runtime?
A: Security teams should treat runtime tool choice as a governed access event, not a normal application call.
Q: Why do AI-generated code pipelines create more security risk than traditional development?
A: They compress the time between defect creation, discovery, and exploitation.
Q: What breaks when security only happens after code is written?
A: Late-stage security turns every finding into a backlog problem and allows high-risk issues to travel into build, supply chain, and runtime environments.
Practitioner guidance
- Prioritise by exploitability, not raw vulnerability count Re-rank findings using attackability, reachability, and exposure duration so teams fix what can be used first.
- Treat AI agents as scoped identities Assign agents explicit tool permissions, short-lived access, and revocation controls so they cannot inherit broad repository, pipeline, or production rights.
- Shift controls left into the IDE and pipeline Use real-time assessment in the IDE, then hybrid scanning in build and CI/CD to reduce the number of defects that reach runtime.
What's in the full article
Checkmarx's full article covers the operational detail this post intentionally leaves for the source:
- The article’s specific examples of agent behaviour that led to deletion, destruction, or other unintended actions.
- The full discussion of how Mythos changes exploit generation speed and why that matters for AppSec teams.
- The detailed breakdown of the four control points across the AI development lifecycle.
- The vendor's framing of hybrid scanning, prioritisation, and runtime feedback loops for AI workloads.
👉 Read Checkmarx's analysis of AI-generated code, agentic risk, and AppSec →
AI-generated code and agentic security: what should teams change now?
Explore further
01/08/2026 10:54 pm
AI-generated code has created an exposure window problem, not just a code-quality problem. When vulnerabilities can be discovered and weaponised faster than teams patch them, security programmes are no longer judged by detection volume alone. The meaningful question is how long a flaw stays reachable after discovery, which aligns directly with NIST CSF’s protect and respond functions. Practitioners should treat remediation latency as a first-class control metric.
A question worth separating out:
Q: How do teams know whether AI governance is actually working?
A: Look for evidence that every AI interaction can be traced end to end, from identity and intent to output and enforcement. If auditors can ask for a transaction and receive a complete record in hours, not weeks, the programme is producing usable control evidence rather than just documentation.
👉 Read our full editorial: AI-generated code is turning AppSec into a runtime risk
