Notifications
Clear all
Topic starter
18/08/2026 3:01 pm
TL;DR: In a survey of 117 security professionals, LEGIT Security found that 82% are already using or experimenting with AI assistants in software development, while 73% worry about new vulnerabilities and 56% cite lack of visibility or control as top concerns. The governance gap is not code generation speed, but the inability of traditional AppSec to inspect, classify, and bound AI-assisted output fast enough.
NHIMG editorial — based on content published by LEGIT Security: Reality Check on Securing AI-Generated Code
By the numbers:
- 82% of respondents are experimenting with or using AI assistants in software development.
- 73% of respondents cite introduction of new vulnerabilities as a top concern related to AI use in software development.
- 56% cite lack of visibility or control over AI-generated code as a top concern.
Questions worth separating out
Q: What breaks when AI-generated code enters delivery pipelines without strong visibility?
A: Security teams lose the ability to distinguish human-written from AI-assisted code, which makes review depth inconsistent and weakens risk triage.
Q: Why do AI coding agents create different governance risks from normal developer tools?
A: AI coding agents combine code execution, context persistence, external tool access, and memory across sessions.
Q: How can organisations tell whether AI-assisted development is actually working?
A: Use downstream indicators such as escaped defects, rework after merge, security findings, and time spent validating generated code.
Practitioner guidance
- Inventory AI-assisted development paths Map every IDE plugin, assistant, model endpoint, and repository integration used in the software delivery chain.
- Classify AI coding access as a governed entitlement Assign access to coding assistants, model gateways, and code repositories to roles with approval, logging, and periodic review.
- Test AI tools for prompt injection and secret leakage Run red-team scenarios that try to coerce assistants into revealing private code, suggestions, or embedded credentials.
What's in the full report
LEGIT Security's full report covers the operational detail this post intentionally leaves for the source:
- Full survey breakdown across 117 security professionals, including where respondents are prioritising AI-generated code controls.
- Detailed findings on how teams are using AI assistants for security tasks and AppSec augmentation.
- Examples of the prompt injection and secret exfiltration vulnerabilities identified in AI coding tools.
- The report's own analysis of how purpose-built AI security tools are expected to change AppSec operations.
👉 Read LEGIT Security's survey on securing AI-generated code →
AI-generated code security: what AppSec teams need to act on?
Explore further
18/08/2026 3:40 pm
AI-generated code creates an assurance gap that AppSec teams are not yet staffed or instrumented to close. Security programmes were built to inspect code after it was written, but AI-assisted development compresses the creation-to-commit window. That leaves less time for human review and more dependence on provenance signals, repository policy, and runtime controls. The practical conclusion is that code assurance now has to start before the pull request, not after it.
A question worth separating out:
Q: Who should be accountable for AI agent security incidents?
A: Accountability should sit with the team that owns the agent's business function and permission model, not with a single security tool owner. If the organisation cannot name who approved the agent's scope, who can revoke it, and who reviews runtime exceptions, the governance model is incomplete.
👉 Read our full editorial: AI-generated code is outpacing AppSec visibility and control
