Notifications
Clear all
Topic starter
01/08/2026 10:50 pm
TL;DR: AI is making vulnerability discovery and exploit generation scalable faster than it is improving secure software by default, while AI-generated code is already linked to 78 CVEs across major tools and 34 more in March 2026 alone, according to Cogent and Georgia Tech's SSLab. The assurance gap, not raw code output, is now the deciding security constraint.
NHIMG editorial — based on content published by Cogent: Better Coding Agents Won't Close the Offense-Defense Gap
By the numbers:
- As of March 2026, it lists 78 AI-linked CVEs across tools including GitHub Copilot, Claude Code, Cursor, and Devin, with 43 rated Critical or High.
- March 2026 alone added 34 CVEs spanning authorization bypasses, XSS, path traversal, and CORS misconfigurations.
Questions worth separating out
A: The control most likely to fail is the trust boundary, not just the code syntax.
Q: Why do AI-assisted coding tools complicate security assurance for enterprise software?
A: They increase code output faster than teams can prove the output is safe.
Q: How can security teams tell whether AI-generated code is actually safe?
A: They should look for security regression evidence, not just test pass rates.
Practitioner guidance
- Prioritise proof-backed review for identity-critical code paths Route authentication, authorisation, session handling, and token-processing changes through deeper verification than standard peer review.
- Create an assurance gate for AI-generated changes Require explicit evidence for any generated or heavily assisted code that touches trust boundaries.
- Treat AI-linked CVEs as a control design signal Track defects by category, especially authorisation bypass, path traversal, XSS, and CORS misconfiguration, to identify where generation tools keep failing.
What's in the full article
Cogent's full blog research covers the operational detail this post intentionally leaves for the source:
- The specific AI research examples cited for exploit discovery across major operating systems and browser codebases.
- The full explanation of why remediation is a verification problem, including the security invariants that can fail during patching.
- The discussion of formal specifications, certificates, and proof checking as a path to secure code generation.
- Cogent's examples of how AI-assisted hardening is being applied to open-source and browser code.
👉 Read Cogent's analysis of why AI vulnerability discovery is outpacing secure code generation →
AI vulnerability discovery is outpacing secure code generation?
Explore further
01/08/2026 10:58 pm
The real security variable is no longer code volume, it is assurance density. AI can produce more code, more bug hypotheses, and more exploit candidates, but that does not mean the security properties of the software improve at the same pace. The article correctly separates generation from verification, and that separation is where programmes are failing. For IAM-heavy systems, the concern is not just defective application logic, but any generated change that weakens authentication, authorisation, or token validation. Practitioners should measure whether assurance scales with change velocity, not whether developer throughput rises.
A question worth separating out:
Q: Who is accountable when AI-assisted development introduces a privilege bypass or access flaw?
A: Accountability stays with the organisation that accepted the change, even if an AI tool helped produce it. Teams need defined ownership for secure coding standards, verification gates, and release approval. The risk is governance failure when no one is responsible for proving that identity and access controls still work after the code changes.
👉 Read our full editorial: AI vulnerability discovery is outpacing secure code generation
