Topic starter
18/08/2026 2:44 pm
TL;DR: AI-assisted development is now mainstream, with GitHub reporting that 92% of developers use AI coding tools and many organisations generating 40% or more of new code with AI, according to LEGIT Security. Traditional AppSec controls were built for post-commit review, but AI code generation at the developer endpoint creates traceability, enforcement, and audit gaps that require pre-commit governance.
Editorial analysis by NHI Mgmt Group, based on content published by LEGIT Security: “Executive Brief: Questions AI is Creating that Security Can't Answer Today”.
Key questions
Q: What breaks when AI-generated code is only checked after commit?
A: Post-commit controls miss the moment when risky code is created, so secrets, insecure patterns, and policy violations can enter the repository before security ever sees them.
Q: Why do auditors care about AI code provenance and policy evidence?
A: Auditors need to know not only what code exists, but how it was produced and whether policy checks were enforced at the point of generation.
Q: What are the signs that release controls are failing around AI-assisted development?
A: Look for missing provenance, repeated contract drift, unreliable rollback decisions, and failures that recur because the root cause was never turned into a reusable gate.
Practitioner guidance
- Implement pre-commit policy enforcement for AI-generated code Evaluate code as it is generated in the developer environment so insecure patterns, secrets, and policy violations are blocked before repository entry.
- Create AI code provenance records Capture prompt, context, tool usage, policy decisions, and developer actions for each generation event so auditors can reconstruct how code was produced.
- Inventory sanctioned AI coding tools Define which code assistants are approved, which teams may use them, and how unauthorised tool use is detected across endpoints.
Bottom line: AI-generated code exposes a timing mismatch between when software is created and when conventional AppSec controls can see it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:27 pm
Pre-commit governance is now the decisive control model for AI-assisted development: traditional AppSec was built to inspect code after humans wrote it, but AI shifts the security decision to the moment of generation. That changes the assurance problem from code review coverage to policy enforcement at the developer endpoint. Practitioners should treat generation-time enforcement as the new audit boundary.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should teams move to pre-commit controls for AI-generated code before strengthening scans?
A: Yes, when AI is already contributing meaningfully to code output. Strengthening scans helps detect issues later, but it does not solve the core governance problem that AI-generated code can reach the repository before any traditional control sees it. Prioritise generation-time enforcement first, then keep scans as a secondary detection layer.
👉 Read our full editorial: AI-generated code is breaking traditional AppSec audit models