Topic starter
02/08/2026 12:14 pm
TL;DR: Security professionals are most worried about the pace of AI and new threats, and 54% said undetected vulnerabilities are the top risk in AI-generated code, underscoring how fast plausible but insecure code can enter pipelines, according to Veracode polls. The governance problem is no longer AI adoption itself, but verification of untrusted code at commit and merge time.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “The New AppSec Reality: AI Anxiety, Silent Flaws, and Supply Chains”.
By the numbers:
- 54% of security professionals in Veracode polls said undetected vulnerabilities were the top risk in AI-generated code.
- 38% of respondents ranked securing the software supply chain as a top concern.
Key questions
Q: What breaks when AI-generated code is only checked after commit?
A: Post-commit controls miss the moment when risky code is created, so secrets, insecure patterns, and policy violations can enter the repository before security ever sees them.
Q: Why do silent flaws in AI-generated code create more risk than obvious defects?
A: Silent flaws are harder to catch because they look functional enough to bypass quick review, yet they can still contain missing validation, unsafe authorization, or secrets exposure.
Q: How should security teams balance speed and verification in AI-assisted development?
A: Use AI to accelerate drafting, but keep the release decision grounded in the same assurance standards used for human-written code.
Practitioner guidance
- Inventory and tag AI-generated code Create a complete inventory of AI-assisted coding tools and require commit-time tagging for generated code so provenance is visible before review starts.
- Enforce merge gates on high-risk findings Block pull requests that introduce new critical or high-severity issues and require automated SAST, SCA, and secrets scanning on every merge request.
- Treat generated code as untrusted input Write policy that requires targeted review for AI-generated snippets, especially around authorization logic, input validation, and hardcoded secrets.
Bottom line: AI-generated code can be syntactically correct and still hide serious flaws that human review misses.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:16 pm
Silent-flaw governance is now an AppSec control problem, not an AI adoption problem. The article’s strongest signal is not that teams are using AI, but that insecure code can now arrive packaged as plausible output. That shifts the burden from developer intent to verification discipline, because review quality degrades when output looks coherent. Practitioners should treat AI-generated code as a controlled input class, not a neutral productivity booster.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations treat AI-generated code as a separate governance category?
A: Yes, because AI-generated code introduces a trust problem that sits between development, application security, and identity governance. Teams need policy for what AI may generate, how outputs are validated, and how identities and secrets are handled in the resulting code. Without that, responsibility for unsafe behaviour becomes fragmented across teams.
👉 Read our full editorial: AI-generated code is creating a silent AppSec failure mode