Notifications
Clear all
Topic starter
02/08/2026 11:40 am
TL;DR: AI coding tools can generate functions, fixes, and dependency changes in seconds, shifting developers from authors to reviewers and creating a gap where insecure patterns, secrets, and risky packages can enter code faster than traditional AppSec checks, according to Checkmarx. The review step is now the security choke point, not the build pipeline.
NHIMG editorial — based on content published by Checkmarx: AI generated code and the Developer Assist workflow
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How can security teams tell whether AI-generated code is actually safe?
A: They should look for security regression evidence, not just test pass rates.
Q: Why do AI coding tools increase secrets risk?
A: AI coding tools increase secrets risk because they can accelerate the reuse of insecure patterns across repositories, test fixtures, and automation scripts.
Q: What do teams get wrong about AI-generated documentation and code review?
A: They often assume documentation or review output is proof of oversight.
Practitioner guidance
- Implement pre-acceptance code validation Surface secrets, vulnerable dependencies, and authentication issues before developers accept AI-generated changes in the editor, not after merge.
- Extend secrets scanning into the developer workflow Run detection when files are opened, edited, saved, or updated by AI so exposed tokens and credentials are flagged while the prompt context is still fresh.
- Apply identity-aware review to generated changes Require reviewers to check whether generated code introduces new service accounts, package credentials, API tokens, or permission changes.
What's in the full article
Checkmarx's full article covers the operational detail this post intentionally leaves for the source:
- How Developer Assist surfaces insecure patterns, malicious packages, and secrets while developers are still editing.
- The specific change types it validates, including multi-file refactors, dependency upgrades, and infrastructure-as-code updates.
- The editor workflow events that trigger scans, such as opening, editing, saving, or AI-driven updates.
- The exact remediation guidance shown before code is accepted into the development workflow.
👉 Read Checkmarx's analysis of AI generated code and Developer Assist →
AI generated code and AppSec: are your review controls keeping up?
Explore further
02/08/2026 12:52 pm
AI generated code creates a review gap, not just a productivity gain. The central governance problem is that developers are being asked to validate output they did not author and often do not fully inspect. Traditional AppSec assumes security review can follow code creation, but AI-assisted workflows compress that window. That means the review function must move closer to generation, with policy and detection operating at the point of acceptance.
A question worth separating out:
Q: How can organisations tell whether AI-assisted development is actually working?
A: Use downstream indicators such as escaped defects, rework after merge, security findings, and time spent validating generated code. If the assistant increases review load, secret exposure, or release friction, the apparent speed gain is likely being paid back later in the delivery lifecycle.
👉 Read our full editorial: AI generated code creates a new AppSec review gap
