AI-generated code security: what AppSec teams need to act on

TL;DR: In a survey of 117 security professionals, LEGIT Security found that 82% are already using or experimenting with AI assistants in software development, while 73% worry about new vulnerabilities and 56% cite lack of visibility or control as top concerns. The governance gap is not code generation speed, but the inability of traditional AppSec to inspect, classify, and bound AI-assisted output fast enough.

NHIMG editorial — based on content published by LEGIT Security: Reality Check on Securing AI-Generated Code

By the numbers:

• 82% of respondents are experimenting with or using AI assistants in software development.
• 73% of respondents cite introduction of new vulnerabilities as a top concern related to AI use in software development.
• 56% cite lack of visibility or control over AI-generated code as a top concern.

Questions worth separating out

Q: What breaks when AI-generated code enters delivery pipelines without strong visibility?

A: Security teams lose the ability to distinguish human-written from AI-assisted code, which makes review depth inconsistent and weakens risk triage.

Q: Why do AI coding agents create different governance risks from normal developer tools?

A: AI coding agents combine code execution, context persistence, external tool access, and memory across sessions.

Q: How can organisations tell whether AI-assisted development is actually working?

A: Use downstream indicators such as escaped defects, rework after merge, security findings, and time spent validating generated code.

Practitioner guidance

• Inventory AI-assisted development paths Map every IDE plugin, assistant, model endpoint, and repository integration used in the software delivery chain.
• Classify AI coding access as a governed entitlement Assign access to coding assistants, model gateways, and code repositories to roles with approval, logging, and periodic review.
• Test AI tools for prompt injection and secret leakage Run red-team scenarios that try to coerce assistants into revealing private code, suggestions, or embedded credentials.

What's in the full report

LEGIT Security's full report covers the operational detail this post intentionally leaves for the source:

• Full survey breakdown across 117 security professionals, including where respondents are prioritising AI-generated code controls.
• Detailed findings on how teams are using AI assistants for security tasks and AppSec augmentation.
• Examples of the prompt injection and secret exfiltration vulnerabilities identified in AI coding tools.
• The report's own analysis of how purpose-built AI security tools are expected to change AppSec operations.

👉 Read LEGIT Security's survey on securing AI-generated code →

AI-generated code security: what AppSec teams need to act on?

Explore further

View Full Forum →  |  NHI Foundation Course →