Topic starter
02/08/2026 11:40 am
TL;DR: AI coding tools can generate functions, fixes, and dependency changes in seconds, shifting developers from authors to reviewers and creating a gap where insecure patterns, secrets, and risky packages can enter code faster than traditional AppSec checks, according to Checkmarx. The review step is now the security choke point, not the build pipeline.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “Cursor Is Changing How Developers Build. Security Has to Change Too.”.
Key questions
Q: What breaks when AI-generated changes are reviewed only at merge time?
A: Merge-time review fails because AI-driven pipelines can create code, dependencies, workflows, and infrastructure in one step.
Q: Why do AI coding tools increase secrets risk?
A: AI coding tools increase secrets risk because they can accelerate the reuse of insecure patterns across repositories, test fixtures, and automation scripts.
Q: What signs show AI-assisted development is outpacing security review?
A: The clearest signs are rising pull request size, fewer but denser merges, more findings per change, and an increase in privilege or secret-related defects.
Practitioner guidance
- Embed security checks in the editor Surface findings while developers are still reviewing AI-generated changes, so insecure patterns and risky dependencies are caught before acceptance.
- Gate acceptance of generated code Require explicit validation for multi-file AI changes, dependency upgrades, and infrastructure edits before they can be merged or committed.
- Scan AI output for secrets and credentials Treat generated code as a possible credential exposure path and check for tokens, keys, and embedded secrets at the point of review.
Bottom line: AI-generated code changes the AppSec problem from author review to acceptance control, which makes the review step the decisive security boundary.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:52 pm
AI-generated code has created a review governance problem, not just a coding productivity problem. When the developer is no longer the sole author, the review function becomes the primary control boundary. That matters because review quality depends on context, and AI-assisted changes often arrive in volumes that exceed human attention. The practical conclusion is that application security now has to govern acceptance decisions, not merely scan finished artefacts.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should security teams use AI-generated code fixes without losing control of AppSec risk?
A: Treat AI-generated fixes as draft remediation, not authoritative change. Security teams should keep the same review, test, and approval gates they use for any vulnerable code change, with extra scrutiny for authentication, secrets, and privilege logic. The goal is to reduce remediation time without weakening assurance or bypassing ownership.
👉 Read our full editorial: AI generated code creates a new AppSec review gap