Notifications
Clear all
Topic starter
19/08/2026 4:07 pm
TL;DR: OWASP’s 2025 update adds Insecure Design and AI-Driven Vulnerabilities to its Top 10, reflecting how autonomous systems and AI coding assistants are now influencing application logic at scale, according to Arnica. The shift makes governance at code generation and design time more important than post hoc scanning, because AI-assisted development can multiply insecure patterns faster than review processes can absorb them.
NHIMG editorial — based on content published by Arnica: What We Learned at OWASP US 2025 (November 2025)
Questions worth separating out
Q: How should security teams implement AI code generation controls in the SDLC?
A: Start at the point of generation, not at the point of release.
Q: Why do AI coding assistants create access control risk in applications?
A: Because they often generate code that assumes the caller is trusted or that sensitive fields are safe to expose.
Q: What breaks when AI-generated code is reviewed without security gates?
A: What breaks is the assumption that a clean-looking diff is a safe diff.
Practitioner guidance
- Move policy into the generation layer Define approved coding rules for AI assistants and enforce them before code is committed, not after pull request review begins.
- Restrict agent authority in development pipelines Limit repository access, deployment permissions, and tool invocation rights for AI systems so they cannot independently modify high-risk paths.
- Bind AI-generated code to accountable review Require traceable approval for AI-assisted changes that affect authentication, authorisation, or data handling logic.
What's in the full article
Arnica's full blog post covers the operational detail this post intentionally leaves for the source:
- Specific examples of how Arnie AI SAST identifies hidden backdoors and authorisation flaws in AI-generated code
- Details on the version-controlled rule files used to push secure coding instructions into AI tools
- Workflow examples showing how findings are delivered into Slack and Microsoft Teams for developer action
- Implementation detail on how continuous enforcement is applied across every push and branch
👉 Read Arnica’s analysis of OWASP’s 2025 appsec update and AI-driven vulnerabilities →
OWASP’s new appsec risks: are your controls keeping up?
Explore further
19/08/2026 4:40 pm
AI-assisted development has created a governance gap, not just a productivity gain. When code generation accelerates faster than review and policy enforcement, security teams inherit a control problem that manual AppSec cannot absorb. The issue is no longer limited to catching vulnerable code after the fact. It is whether the organisation can govern the decisions made by the system generating that code. Practitioner conclusion: policy must move upstream into the generation workflow.
A question worth separating out:
Q: Who should be accountable for AI agent actions in enterprise systems?
A: Accountability should sit with the team that owns the agent, its policies, and the connected tools, not only with the person who typed the original prompt. When a software actor can send messages, update records, and move data across systems, responsibility must follow the governed identity and its enforcement layer.
👉 Read our full editorial: OWASP’s 2025 appsec update shifts risk toward AI-driven code
