Topic starter
01/08/2026 10:50 pm
TL;DR: AI is making vulnerability discovery and exploit generation scalable faster than it is improving secure software by default, while AI-generated code is already linked to 78 CVEs across major tools and 34 more in March 2026 alone, according to Cogent and Georgia Tech's SSLab. The assurance gap, not raw code output, is now the deciding security constraint.
Editorial analysis by NHI Mgmt Group, based on content published by Cogent: “Better Coding Agents Won't Close the Offense-Defense Gap”.
By the numbers:
- Vibe Security Radar listed 78 AI-linked CVEs across tools including GitHub Copilot, Claude Code, Cursor, and Devin as of March 2026.
- March 2026 alone added 34 CVEs spanning authorization bypasses, XSS, path traversal, and CORS misconfigurations.
Key questions
Q: What breaks when teams assume AI-generated code is secure by default?
A: When teams assume AI-generated code is secure by default, they miss common failure modes such as embedded secrets, unsafe dependencies, missing validation, and maintainability problems that later become vulnerabilities.
Q: Why does faster code generation not eliminate security risk?
A: Because security risk is created by unproven behaviour, not just by code volume.
Q: What signs show AI-assisted development is outpacing security review?
A: The clearest signs are rising pull request size, fewer but denser merges, more findings per change, and an increase in privilege or secret-related defects.
Practitioner guidance
- Strengthen verification for identity-critical code Apply stricter review, fuzzing, and test coverage to authentication, authorisation, token, and secret-handling paths before merging AI-generated changes.
- Require checkable intent for high-risk components Express security requirements as explicit assertions or formal specifications for parsers, protocol handlers, and access-control logic that AI helps generate.
- Gate AI-assisted patches on regression-proof evidence Do not treat a patch as complete until it has evidence that it preserves the intended invariant and does not expand the attack surface.
Bottom line: AI is making vulnerability discovery and exploit development cheaper at the same time that secure code generation remains difficult to prove, which widens the assurance gap.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:58 pm
Assurance debt is now the primary software-security constraint. The article is not really about coding speed. It is about the growing gap between how quickly code can be produced and how slowly teams can prove that it is safe. That gap becomes especially visible in code that touches identity, authentication, and authorisation, where one defective assumption can break the control plane for the whole application. Practitioners should treat assurance as a first-class governance issue, not a downstream testing activity.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams govern AI-generated code in production environments?
A: Security teams should treat AI-generated code as normal production code with extra provenance risk. Require architectural review, test coverage, static analysis, and approval before merge. Then bind the agent and the build pipeline to least privilege, short-lived credentials, and complete audit logging so implementation speed does not outrun control.
👉 Read our full editorial: AI vulnerability discovery is outpacing secure code generation