Topic starter
02/08/2026 12:17 pm
TL;DR: AI-assisted software development is compressing attacker and defender timelines, while large code-generation bursts, API sprawl, and semantic attacks like promptware bypass traditional AppSec review and signature-based controls, according to Impart. The security model is shifting from visibility and scanning toward runtime enforcement that can evaluate intent, not just syntax.
Editorial analysis by NHI Mgmt Group, based on content published by Impart: “The AppSec Innovation Crisis”.
By the numbers:
- Security research has shown that a functional proof-of-concept exploit can be generated and executed in under 23 minutes.
Key questions
Q: What breaks when AI-assisted coding outpaces AppSec review cycles?
A: Manual triage and blanket scanning lose effectiveness when code volume rises faster than security capacity.
Q: Why do AI-generated APIs create more security risk than normal release speed?
A: AI-generated APIs create risk because they expand the attack surface as they are created, and many are launched without mature scoping, ownership, or access rules.
Q: What are the signs that signature-based AppSec controls are failing against LLM attacks?
A: The warning signs are attacks that evade fixed patterns, shift wording or structure, and still achieve the same malicious outcome.
Practitioner guidance
- Enforce runtime policy for AI-generated code Move from review-only controls to runtime enforcement that can block unsafe behaviour after code reaches execution paths, especially where generated code changes too quickly for manual triage.
- Inventory APIs created by AI-assisted development Automatically discover new endpoints, map ownership, and require authentication and authorisation checks before release so unreviewed microservices do not become shadow attack surface.
- Test for semantic attack resistance Validate LLM-facing applications against prompt injection and promptware scenarios that change intent, context, or data access rather than matching fixed malicious strings.
Bottom line: AI-assisted development is compressing the time available for security review, which makes legacy AppSec gates easier to bypass.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:18 pm
AI-driven AppSec creates a velocity gap, not just a tooling gap. The article shows that generated code can outpace human review, which means the old assumption that security has time to inspect every meaningful change is no longer dependable. In practice, the review model itself becomes the control failure when change volume exceeds analyst throughput.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should security teams control AI-assisted development when release speed keeps increasing?
A: Security teams should place policy and testing controls earlier in the delivery flow, then focus remediation on the systems where code velocity, privileged automation, and external dependencies intersect. The goal is not to slow every team equally. It is to prevent fast-moving pipelines from turning known weaknesses into repeated exposure.
👉 Read our full editorial: AI-driven appsec velocity is breaking legacy review models