AI-generated code and toxic combinations: what AppSec teams need now

TL;DR: AI-led software development now requires discovery of AI use, AI-specific security testing, threat modelling for new AI components, and control of toxic combinations such as GenAI use alongside missing branch protection, according to LEGIT Security. The core issue is not AI itself but unmanaged change in the software supply chain and the governance gap it creates.

NHIMG editorial — based on content published by LEGIT Security: 4 new AppSec requirements in the AI-led software development era

Questions worth separating out

Q: How should security teams govern AI-generated code in production pipelines?

A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.

Q: Why do AI coding tools create a security risk even when code looks correct?

A: They optimise for syntax and pattern completion, not contextual security reasoning.

Q: What breaks when branch protection and code review are missing in GenAI workflows?

A: The release process stops acting as a control boundary.

Practitioner guidance

• Map AI use across development environments Inventory every repository, pipeline, IDE plugin, model integration, and MCP connection that touches code generation or analysis.
• Add AI-specific security checks before release Extend AppSec testing to cover model provenance, prompt handling, malicious model detection, and behaviour under manipulated inputs.
• Trigger threat modelling on AI introduction Require a formal threat model whenever a team introduces an AI component, an agent, or a user-facing model interface.

What's in the full article

LEGIT Security's full whitepaper covers the operational detail this post intentionally leaves for the source:

• Practical guidance on identifying AI-generated code and AI services across development environments
• The article’s breakdown of AI-specific security testing gaps, including model poisoning and excessive agency
• Examples of toxic combinations such as GenAI use paired with missing branch protection or code review

👉 Read LEGIT Security's whitepaper on AppSec requirements for the AI-led software development era →

AI-generated code and toxic combinations: what AppSec teams need now?

Explore further

View Full Forum →  |  NHI Foundation Course →