Notifications
Clear all
Topic starter
01/08/2026 8:54 pm
TL;DR: Frontier models produced working code 83% to 95% of the time, but secure and functional output reached only 24% to 36%, rising to 47% to 56% with added security steps, according to Checkmarx research. The gap shows why AppSec cannot rely on generation quality alone; deterministic verification and AI-assisted remediation have to work together.
NHIMG editorial — based on content published by Checkmarx: Don’t Put All Your Code in One Basket
By the numbers:
- Frontier models now produce working code 83% to 95% of the time, but secure and functional code reaches only 24% to 36%.
- Adding inference-time security steps raises the secure and functional rate from 24% to 36% to 47% to 56%.
- Checkmarx says its hybrid engine achieved an F1 score of 0.64 across seven production codebases.
Questions worth separating out
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.
Q: When does AI-assisted development create more risk than it reduces?
A: It becomes net risk when code volume grows faster than ownership, review, and fix capacity.
Q: What do security teams get wrong about AI-generated code risk?
A: They often focus on catching insecure output after code is written, which is too late for AI-native workflows.
Practitioner guidance
- Embed independent verification before merge Require every AI-generated change to pass deterministic checks, security review, and policy enforcement before it can merge into the main branch.
- Inventory AI components as governed assets Track models, agents, MCP servers, and SDKs in an AI-BOM so ownership, access, and review obligations are explicit.
- Prioritise risk-based remediation over raw finding volume Use reachability, exploitability, and business context to sort findings so teams fix what can actually be abused first.
What's in the full article
Checkmarx's full article covers the operational detail this post intentionally leaves for the source:
- The step-by-step breakdown of its hybrid AppSec workflow for deterministic checks and AI-assisted reasoning
- The specific benchmark setup behind the reported F1 score and secure-code rates
- The product-level detail behind Triage Assist, Remediation Assist, Developer Assist, and AI Inventory
- The full discussion of the AI development lifecycle control points and remediation economics
👉 Read Checkmarx's analysis of AI-generated code, hybrid AppSec, and AI Inventory →
AI-generated code and the AppSec gap: are your controls keeping up?
Explore further
01/08/2026 9:02 pm
AI-generated code creates an assurance gap, not just a productivity gain. The real problem is that output quality and security quality are not the same thing, and organisations often optimise for throughput first. That creates a control gap in which functional code is accepted before it is independently verified. For AppSec teams, the practitioner conclusion is simple: generation speed cannot become the security standard.
A question worth separating out:
Q: How can organisations reduce AI-driven vulnerability backlog faster?
A: Use context-aware remediation that prioritises reachable, exploitable issues and generates fixes developers can apply quickly. Combine that with clear ownership and policy gates so the backlog shrinks without weakening controls. The goal is faster verified removal of risk, not just more alerts.
👉 Read our full editorial: AI-generated code needs hybrid AppSec controls, not model-only security
