Topic starter
19/08/2026 3:31 pm
TL;DR: Only 22% of consumers believe most mobile app code is AI-generated, LEGIT Security’s survey found, while 47% are concerned about AI in apps and 31% flag sensitive data requests as their top concern. App teams need to treat disclosure, permissions and data handling as part of the trust model.
Editorial analysis by NHI Mgmt Group, based on content published by LEGIT Security: “Survey Reveals Consumer Sentiment on AI-Created Apps”.
By the numbers:
- Only 22% of respondents believe a typical mobile app’s code is mostly AI-generated.
- Nearly 90% of developers surveyed report using AI coding assistants.
- 47% of respondents say they are concerned about AI in apps.
Key questions
Q: Why do AI-built apps raise trust concerns for consumers?
A: Consumers cannot directly see how much AI shaped the app, what data it consumes, or whether AI changed the underlying permission model.
Q: What mistakes do AppSec teams make when they treat AI as a separate silo?
A: They usually overvalue narrow AI scanners and undervalue the surrounding application graph.
Q: How should security teams govern AI use in developer tooling?
A: Security teams should govern AI use as a data and access problem, not only a productivity feature.
Practitioner guidance
- Inventory AI usage across the software lifecycle Map where AI coding assistants, model calls, and AI-driven features are used in development, testing, and production so that governance covers the full path.
- Tighten data minimisation for AI-enabled features Review whether AI-powered functions really need access to voice, images, location, behavioural data, or other sensitive inputs before they are exposed.
- Align user-facing trust signals with real controls Make privacy notices, app permissions, and consent language consistent with how the application actually processes data and uses AI.
Bottom line: AI-built apps are changing the trust boundary because users judge safety from disclosure, permissions, and data handling, not only from code quality.
Glossary terms: API Governance Debt, Toxic Risk Combinations, AI visibility, Human-Agent Trust Exploitation (ASI09)
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
19/08/2026 4:14 pm
AI-assisted software delivery has become a trust governance problem, not only a development productivity trend. Once AI is part of the build path, organisations must govern what the software can do, what data it can touch, and what users are told about those choices. That shifts the conversation from code generation to control design, because transparency and permission scope now influence whether the product is considered trustworthy. The practitioner conclusion is simple: AI visibility belongs in application governance.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations change identity and access controls for AI-enabled apps?
A: Yes, when AI features fetch data, call tools, or act on behalf of users or the application, access control must cover those machine-mediated paths. That means limiting privileges, scoping data access tightly, and reviewing delegated access with the same discipline used for other non-human workflows.
👉 Read our full editorial: Consumer trust in AI-built apps is lagging behind their use