Notifications
Clear all
Topic starter
02/08/2026 11:36 am
TL;DR: AI-generated code can carry two to three times the vulnerability density of human-written code, while 81% of organisations still knowingly ship software with identified vulnerabilities, according to Checkmarx research. The security gap is no longer just volume. It is the loss of context, the acceleration of exploitation, and the need for automated controls that operate at code-creation speed.
NHIMG editorial — based on content published by Checkmarx: AI-generated code is accelerating appsec risk
By the numbers:
- Roughly 70% of a typical enterprise application is made up of open-source components.
- 81% of organizations knowingly ship software with vulnerabilities they’ve already identified.
Questions worth separating out
Q: What breaks when AI-generated code is reviewed without security gates?
A: What breaks is the assumption that a clean-looking diff is a safe diff.
Q: Why do AI-assisted coding tools complicate security assurance for enterprise software?
A: They increase code output faster than teams can prove the output is safe.
Q: How do security teams know if AI tool configuration is creating hidden execution risk?
A: Look for machine-wide settings stored in locations writable by standard users, especially if those settings control hooks, startup actions or shell commands.
Practitioner guidance
- Protect developer and pipeline identities first Inventory developer accounts, CI/CD service accounts, and automation credentials with the same rigor used for production privilege.
- Pair AI-generated code review with deterministic scanning Use SAST, SCA, and infrastructure-as-code scanning in the same pipeline stage as generation or commit, not after merge.
- Govern open-source usage with package validation controls Allowlist approved registries, validate package provenance, and flag typosquatting or newly introduced dependencies in high-risk projects.
What's in the full article
Checkmarx's full article covers the operational detail this post intentionally leaves for the source:
- The NYSE interview framing behind the article’s argument on AI-assisted development and security pressure.
- The discussion of Claude Mythos, including the article’s claims about autonomous vulnerability discovery speed and exploit economics.
- The article’s perspective on agentic application security and why the vendor argues security must move into the development flow.
- The specific product context around Developer Assist, Triage Assist, and Remediation Assist, which this analysis does not evaluate.
👉 Read Checkmarx's analysis of AI-generated code risk and agentic appsec →
AI-generated code and appsec gaps: what practitioners need to know?
Explore further
02/08/2026 12:49 pm
AI-generated code has created an appsec velocity problem, not just a quality problem. The security challenge is no longer limited to finding defects. It is that defects are being introduced at a rate that overwhelms the traditional human review model and stretches remediation windows beyond what defenders can manage. For identity and access programmes, that means developer tooling, build systems, and code-signing trust must be treated as governed assets, not informal productivity layers. The practitioner conclusion is simple: if creation is machine-speed, control must be machine-speed too.
A question worth separating out:
Q: What should organisations do when developers are shipping more code than security can review?
A: Introduce automated controls inside the development pipeline, tighten access to build and deployment identities, and use policy to block high-risk dependency patterns. The goal is to make risk decisions before code reaches production, not after. If review happens too late, remediation becomes incident response by another name.
👉 Read our full editorial: AI-generated code is outpacing appsec controls, and attackers know it
