AI-generated code and SSDF gaps: what security teams need to know

TL;DR: NIST’s SSDF needs to change because AI code generation breaks its assumptions about deterministic tools, human-scale review, and passive tooling, according to Sonar. The practical shift is toward mandatory automated verification, layered review, and supply-chain controls that validate outcomes before release.

NHIMG editorial — based on content published by Sonar: SSDF must evolve for AI-generated code and active attack surfaces

By the numbers:

• Sonar analyzes more than 750 billion lines of code every day across 7 million software developers.
• LLM patches modify an average of 14x more code than traditional tools, and agentic workflows correlate with a 3 to 5x increase in lines added per project.
• Sonar's research found that coding models, left unverified, produce roughly 1,200 security issues per million lines of code analyzed.

Questions worth separating out

Q: What breaks when AI-generated code is reviewed without security gates?

A: What breaks is the assumption that a clean-looking diff is a safe diff.

Q: Why do AI coding tools complicate governance and auditability?

A: AI coding tools complicate governance because teams can adopt them informally, outside central visibility and approval.

Q: How can security teams tell whether AI-generated code is actually safe?

A: They should look for security regression evidence, not just test pass rates.

Practitioner guidance

• Mandate deterministic verification for AI-authored code Require static analysis, SCA, and CI validation on every AI-generated change before merge or release, especially where output is non-deterministic or large enough to evade human inspection.
• Set review thresholds by patch complexity Define maximum AI-authored diff sizes, dependency-change limits, and escalation rules that push oversized changes into deeper automated inspection.
• Treat coding agents as governed NHI principals Inventory AI coding tools, CI bots, and build automations as non-human identities with scoped permissions, short-lived credentials where possible, and explicit offboarding when the task ends.

What's in the full article

Sonar's full analysis covers the operational detail this post intentionally leaves for the source:

• Benchmark data on AI-authored pull request size, review effort, and verification gaps across production codebases
• Specific examples of how Sonar's Guide-Verify-Solve framework maps to pre-generation context, post-generation analysis, and targeted remediation
• The article's discussion of SSDF control changes, including how PW.5, PW.7, and PW.8 should adapt to AI-generated code
• The alignment Sonar suggests between SSDF updates and EU Cyber Resilience Act documentation and vulnerability-handling requirements

👉 Read Sonar's analysis of how AI-generated code changes SSDF controls →

AI-generated code and SSDF gaps: what security teams need to know?

Explore further

View Full Forum →  |  NHI Foundation Course →