Topic starter
18/08/2026 3:01 pm
TL;DR: In a survey of 117 security professionals, LEGIT Security found that 82% are already using or experimenting with AI assistants in software development, while 73% worry about new vulnerabilities and 56% cite lack of visibility or control as top concerns. The governance gap is not code generation speed, but the inability of traditional AppSec to inspect, classify, and bound AI-assisted output fast enough.
Editorial analysis by NHI Mgmt Group, based on content published by LEGIT Security: “Securing AI-Generated Code: What Does It Look Like in Practice?”.
By the numbers:
- 82% of respondents are experimenting with or using AI assistants in software development.
- 73% of respondents cite introduction of new vulnerabilities as a top concern related to AI use in software development.
- 56% cite lack of visibility or control over AI-generated code as a top concern.
Key questions
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.
Q: Why does AI-assisted development increase application identity risk?
A: Because many applications implement identity controls in code, and AI tools can reproduce insecure login, token, and access patterns at scale.
Q: What are the signs that AI-generated application code has weak access control?
A: Look for tables exposed without effective policies, permissive access conditions, authentication that blocks legitimate users, and unexplained access to sensitive actions such as bulk email or account deletion.
Practitioner guidance
- Map every AI coding entry point Catalogue IDE copilots, chat-based coding helpers, repository bots, and agentic developer tools so you know where machine-generated code can enter the delivery chain.
- Require provenance for generated code Tag AI-assisted commits, preserve prompt and suggestion context where feasible, and make review workflows distinguish machine-authored changes from human-authored ones.
- Add AI-specific checks to AppSec Extend code review with prompt-safety, assistant-integrity, and secret-exposure controls so scanning is not limited to static source findings.
Bottom line: AI-generated code widens the gap between development speed and AppSec oversight, especially when teams cannot reliably see where machine-assisted code is entering the pipeline.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:40 pm
AI-generated code creates governance debt faster than most AppSec programmes can absorb. The core issue is not simply that code is being produced faster, but that the trust boundary around authorship has changed. Security teams now have to govern machine-assisted output as a distinct intake stream, which means review, approval, and exception handling need to understand provenance, not just syntax. Practitioners should treat AI-assisted delivery as a separate control domain, not a minor variation of normal development.
A question worth separating out:
Q: What should organisations do when AI coding assistants touch private repositories?
A: Restrict assistant access until logging, policy enforcement, and approval workflows are in place for sensitive codebases. Private repositories deserve stricter governance because assistant prompts, suggestions, and generated snippets can expose code or secrets if the toolchain is not bounded. The decision should be based on visibility and control, not developer convenience.
👉 Read our full editorial: AI-generated code is outpacing AppSec visibility and control