Topic starter
02/08/2026 11:36 am
TL;DR: As AI-generated code enters production workflows, 81% of organisations knowingly ship vulnerable code and 45% of AI-generated code may be insecure, according to Checkmarx research cited alongside Gartner guidance. The governance gap is now larger than the tooling gap, because speed without accountable review and continuous enforcement converts productivity into security debt.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “The Vibe Coding Hangover”.
By the numbers:
- 81% of organisations knowingly ship vulnerable code, according to Checkmarx's Future of Application Security report.
- Up to 45% of AI-generated code may be insecure, according to Checkmarx research cited in the article.
Key questions
Q: How should teams govern AI-generated code when they cannot review every change?
A: Teams should shift from source-only assurance to runtime assurance.
Q: Why do AI-generated code changes increase application security risk?
A: AI-generated code can increase risk because it accelerates output faster than review, testing, and secret hygiene can keep up.
Q: What are the signs that AI-assisted development is creating AppSec debt?
A: The clearest signs are growing backlog, findings that arrive after commit, repeated rework on the same classes of issues, and heavy dependence on late-stage scans.
Practitioner guidance
- Assign accountable AI code owners Name specific individuals responsible for the security and quality of AI-generated code, including escalation when risky output reaches review or release stages.
- Define allow and deny rules for AI coding tools Set explicit policy for which coding assistants, models, data sources, and prompt patterns are permitted, then embed those rules into engineering governance.
- Embed layered scanning in the development workflow Use multiple detection methods across IDE, pull request, dependency, and runtime checkpoints so findings appear before code is merged or deployed.
Bottom line: AI-generated code can speed delivery and still widen AppSec exposure when review and governance are not scaled with it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:49 pm
AI-generated code creates AppSec debt because governance still assumes human-paced development. The core failure is not that teams lack scanners, but that their control model expects security to catch up after code exists. When code production accelerates faster than review, backlog becomes structural risk rather than operational noise. The practitioner conclusion is simple: review cadence must match generation cadence, or the backlog becomes the control failure.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What should security leaders do when AI agents are writing code across the development lifecycle?
A: Set explicit accountability for independent verification at each stage where code is generated, merged, and maintained. Leaders should require evidence that AI-authored changes were checked against security and access-control standards before release, because trust in provenance is not a substitute for trust in outcome.
👉 Read our full editorial: AI-generated code is widening the application security gap