Topic starter
19/08/2026 3:33 pm
TL;DR: AI-assisted coding is widening the gap between software production and software review, LEGIT Security reports, as faster development pushes trust and provenance checks later in the process. AppSec has to govern prompts, agents and release boundaries before insecure changes are baked into the stack.
Editorial analysis by NHI Mgmt Group, based on content published by LEGIT Security: “How AI Is Changing the Software Development Process, and Product”.
By the numbers:
- 81% of developers surveyed reported using AI-powered coding assistants.
- 96% of security and software development professionals report that their companies use GenAI-based solutions for building or delivering applications.
- 88% of developers surveyed report using AI coding assistants.
Key questions
Q: Why does vibe coding increase application security risk?
A: Because it increases the volume and speed of code changes faster than traditional review and scanning can absorb.
Q: What breaks when AI agents can generate code but cannot validate, test, or correct it end to end?
A: When agents can only generate code, teams often get incomplete output that still needs manual cleanup, integration work, and debugging.
Q: How should security teams implement AI code generation controls in the SDLC?
A: Start at the point of generation, not at the point of release.
Practitioner guidance
- Establish prompt-to-production governance Define controls for AI-assisted coding that cover prompt approval, generated output review, dependency validation and release authorization.
- Constrain agent permissions in delivery pipelines Limit what coding agents can read, write, test and deploy, and log every tool action they take across repositories and CI/CD.
- Require provenance for AI-generated changes Track which changes were produced by assistants or agents, then attach that provenance to code review and release records.
Bottom line: AI-generated code changes application security by altering both how software is produced and what software now contains.
Glossary terms: AI-generated code, Vibe Coding, AI-in-the-Stack, Software Trust
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 15 hours ago by NHI Mgmt Group
19/08/2026 4:15 pm
AI-generated code creates governance debt, not just code volume. The central issue is that security teams inherit more software, more quickly, while also inheriting uncertainty about how much of it was machine-generated and how much human review it received. That weakens traditional assurance models that depend on authorship, manual inspection and stable change windows. Practitioners should treat AI-generated code as a governance problem that spans AppSec, SDLC control and identity-aware access to development systems.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How do AppSec and IAM work together for AI-in-the-stack software?
A: AppSec defines what the software should and should not do, while IAM governs which non-human actors can create, modify or exercise those capabilities during development and runtime. When AI becomes part of the stack, the two disciplines need a shared view of tool access, data access and release authority.
👉 Read our full editorial: AI-generated code is reshaping AppSec and software trust models