Topic starter
19/08/2026 3:27 pm
TL;DR: AI code generation can produce working code 83% to 95% of the time, but only 24% to 36% of outputs are both functional and secure, according to Checkmarx-initiated research. Adding a post-generation security review lifts the secure-and-functional rate to 47% to 56%, showing that application security now has to verify what models produce, not just whether it runs.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “The Next Model Won’t Fix This: Four AppSec Imperatives From Black Hat USA 2026”.
By the numbers:
- Frontier models produced working code 83% to 95% of the time on real-world repository tasks.
- Only 24% to 36% of AI-generated solutions were both functional and secure.
- Adding a post-generation security review raised the secure-and-functional rate to 47% to 56%.
Key questions
Q: How should teams govern AI-generated code when they cannot review every change?
A: Teams should shift from source-only assurance to runtime assurance.
Q: Why do AI coding agents require independent verification even when they appear to work well?
A: AI coding agents are probabilistic, so the same prompt can produce different outputs over time.
Q: What signs show that AI-driven development is overwhelming AppSec controls?
A: Common signs include review backlogs that keep growing, findings that cannot be prioritised by business impact, and a gap between code creation and human verification.
Practitioner guidance
- Implement independent validation for generated code Use a review path that is separate from the model that produced the code, and make deterministic analysis part of the approval gate for AI-assisted changes.
- Treat functional test success as insufficient evidence Require security checks that look for insecure logic, unsafe dependencies, and access control flaws even when the code compiles and passes unit tests.
- Map model access to software-change boundaries Inventory which AI tools, agents, and coding workflows can modify files, install packages, call APIs, or trigger commits, then constrain those actions to the minimum required scope.
Bottom line: AI-generated code can be functionally correct while still failing security expectations, so AppSec cannot rely on build or test success as proof of trustworthiness.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:11 pm
AI-generated code creates a trust problem before it creates a vulnerability problem: AppSec teams are being asked to trust outputs that can be syntactically correct, functionally valid, and still insecure. That shifts security from post-build defect detection toward independent validation of model-produced software. The practical conclusion is that trust signals based only on function are no longer sufficient.
A question worth separating out:
Q: How do organizations balance AI development speed with application security governance?
A: Organizations should make security part of the development loop, not a separate phase. That means setting explicit security requirements in prompts, scanning running applications during development, and verifying that remediations actually hold. The goal is to preserve AI-driven velocity while keeping approval, testing, and accountability aligned with production risk.
👉 Read our full editorial: AI-generated code exposes an AppSec trust gap beyond test results