Notifications
Clear all
Topic starter
19/08/2026 3:29 pm
TL;DR: AI is accelerating code volume, supply chain exposure, and secret leakage faster than human review capacity can scale, according to LEGIT Security, while Gartner warns that prompt injection and vibe coding are already creating measurable appsec exposure. The practical issue is not AI novelty but governable control loss across code generation, model inputs, and third-party dependencies.
NHIMG editorial — based on content published by LEGIT Security: AI introduces new risk to software development and appsec
By the numbers:
- Through 2029, over 50% of successful cybersecurity attacks against AI agents will exploit access control issues, using direct or indirect prompt injection as an attack vector.
- By 2027, at least 30% of application security exposures will result from usage of vibe coding practices.
Questions worth separating out
Q: How should security teams govern AI code assistants that have repository and cloud access?
A: Security teams should govern AI code assistants as privileged non-human identities with explicit ownership, least privilege, and continuous logging.
Q: Why do AI coding agents increase supply-chain risk?
A: AI coding agents can choose tooling, install packages, and edit lock files in ways that may bypass the controls humans expect in a managed environment.
Q: What breaks when indirect prompt injection is not controlled in AI systems?
A: Indirect prompt injection breaks the assumption that retrieved content is safe to use as instruction material.
Practitioner guidance
- Define AI coding tool trust boundaries Classify every code assistant, agent, and model integration by the data it can see, the commands it can run, and the repositories it can touch.
- Review delegated permissions for coding agents Inventory the service accounts, API keys, and OAuth grants used by AI development tools.
- Validate AI-generated dependencies before merge Require dependency provenance checks, software composition analysis, and human approval for any library or code block produced by an AI tool.
What's in the full article
LEGIT Security's full analysis covers the operational detail this post intentionally leaves for the source:
- Specific examples of AI-generated code failure modes that teams can test for in review and pipeline controls
- Details on the GitLab Duo prompt injection finding and the kinds of data it exposed
- Examples of how autonomous AI agents can be constrained when they are allowed to use external tools
- Practical guidance on securing AI-generated code without blocking development workflows
👉 Read LEGIT Security's analysis of AI-generated code risk in application security →
AI-generated code risk is growing faster than appsec review can handle?
Explore further
19/08/2026 4:12 pm
AI-generated code is now an identity governance problem, not just an application security problem. When AI tools can create, suggest, or execute code, they rely on credentials, API tokens, repository permissions, and execution rights that must be scoped and revoked. That means the security failure is often over-delegated access rather than code quality alone. Practitioners should manage AI development systems as governed identities with explicit authority boundaries.
A question worth separating out:
Q: How should organisations decide when to allow autonomous coding agents?
A: Allow autonomy only when the task is bounded, reproducible, and reversible. If the work can change multiple files, call external tools, or run in cloud environments, it needs stronger scoping, monitoring, and rollback readiness. Higher autonomy should always require higher assurance, not just faster delivery.
👉 Read our full editorial: AI-generated code expands appsec risk faster than human review
