Topic starter
02/08/2026 11:36 am
TL;DR: 81% of organisations knowingly ship vulnerable code, which Checkmarx survey evidence links to AI-generated code entering production workflows. Application security now has to govern faster release paths, or vulnerability backlog will keep moving downstream.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “The Vibe Coding Hangover”.
By the numbers:
- 81% of organisations knowingly ship vulnerable code, according to Checkmarx's Future of Application Security report.
- Up to 45% of AI-generated code may be insecure, according to Checkmarx research cited in the article.
Key questions
Q: Why do AI-generated code changes increase application security risk?
A: AI-generated code can increase risk because it accelerates output faster than review, testing, and secret hygiene can keep up.
Q: What are the signs that AI-assisted development is creating AppSec debt?
A: The clearest signs are growing backlog, findings that arrive after commit, repeated rework on the same classes of issues, and heavy dependence on late-stage scans.
Q: How should teams govern AI-generated code when they cannot review every change?
A: Teams should shift from source-only assurance to runtime assurance.
Practitioner guidance
- Assign accountable AI code owners Name specific individuals responsible for the security and quality of AI-generated code, including escalation when risky output reaches review or release stages.
- Define allow and deny rules for AI coding tools Set explicit policy for which coding assistants, models, data sources, and prompt patterns are permitted, then embed those rules into engineering governance.
- Embed layered scanning in the development workflow Use multiple detection methods across IDE, pull request, dependency, and runtime checkpoints so findings appear before code is merged or deployed.
Bottom line: AI-generated code can speed delivery and still widen AppSec exposure when review and governance are not scaled with it.
Glossary terms: Agentic coding assistant, AppSec Throughput Debt, AI-BOM, Defense-in-Depth for Code Review
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 12:49 pm
AI-generated code creates AppSec debt because governance still assumes human-paced development. The core failure is not that teams lack scanners, but that their control model expects security to catch up after code exists. When code production accelerates faster than review, backlog becomes structural risk rather than operational noise. The practitioner conclusion is simple: review cadence must match generation cadence, or the backlog becomes the control failure.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What should security leaders do when AI agents are writing code across the development lifecycle?
A: Set explicit accountability for independent verification at each stage where code is generated, merged, and maintained. Leaders should require evidence that AI-authored changes were checked against security and access-control standards before release, because trust in provenance is not a substitute for trust in outcome.
👉 Read our full editorial: AI-generated code turns AppSec governance into a delivery problem
This post was modified 2 days ago by NHI Mgmt Group