Notifications
Clear all
Topic starter
21/08/2026 4:46 pm
TL;DR: AI-assisted development is shipping more security defects, with CodeRabbit finding 2.74× more cross-site scripting issues and 10.83 issues per pull request versus 6.45 in human-only code, while five studies collectively point to a widening gap between code generation speed and remediation capacity, according to Pixee. The practical lesson is that organisations need automated review and fix pipelines that can keep pace with AI output, not just more manual gates.
NHIMG editorial — based on content published by Pixee: The 2.74× Problem: New Data Shows AI Code Ships With Nearly 3× More Security Flaws
By the numbers:
- AI-assisted PRs contain 2.74× more cross-site scripting vulnerabilities than human-only PRs.
- 34% of code in enterprise repositories is now AI-generated.
Questions worth separating out
Q: What breaks when AI-assisted code is merged without provenance controls?
A: When AI-assisted code is merged without provenance controls, teams lose attribution, review evidence, and incident reconstruction capability.
Q: Why do AI coding agents create different governance risks from normal developer tools?
A: AI coding agents combine code execution, context persistence, external tool access, and memory across sessions.
Q: How do you know if AI code review controls are working?
A: Look for reduced defect density in AI-assisted pull requests, faster closure of high-severity findings, and fewer escaped issues in authentication, authorisation, and session workflows.
Practitioner guidance
- Enforce commit-time security gates for AI-generated code Block merges until automated checks validate XSS, access-control, and password-handling patterns in AI-authored changes, especially in authentication and session code.
- Separate routine fixes from architectural review Route predictable issues such as insecure direct object references and weak input handling to automated fix generation, while reserving human review for trust-boundary changes.
- Measure remediation age alongside code velocity Track mean time to remediate, backlog age, and reopen rates for vulnerabilities introduced by AI-assisted pull requests so leadership sees capacity gaps early.
What's in the full article
Pixee's full analysis covers the operational detail this post intentionally leaves for the source:
- The specific merge-rate and remediation benchmarks behind the automated fix claims, useful if you need to justify pipeline changes.
- The study-by-study breakdown of how AI-generated defects differ from human-written defects across validation and authorisation paths.
- The market context behind security automation acquisitions and how those moves reflect pressure on AppSec teams.
- Implementation detail on how fix-generation workflows fit into developer and security review processes.
👉 Read Pixee's analysis of why AI-generated code ships with nearly 3× more security flaws →
AI-generated code flaws: is your AppSec process keeping up?
Explore further
21/08/2026 5:05 pm
AI-assisted development has turned code review into an identity and trust problem, not just a software quality problem. When code is generated by systems that do not understand the organisation’s authentication, authorisation, or secrets policies, insecure identity logic can be copied into production at machine speed. That makes AI-generated code a governance issue for IAM, PAM, and application security teams alike. The practitioners who own access policy need to be in the review loop before insecure patterns become part of the runtime trust model.
A question worth separating out:
Q: Should organisations automate fixes for AI-generated vulnerabilities?
A: Yes, for repeatable flaw classes where the fix is well understood and the risk of delay is high. Automated remediation should handle predictable issues such as input validation, secret handling, and object reference mistakes, while humans focus on architectural decisions and exceptions. That division is the only scalable way to keep pace with AI-assisted delivery.
👉 Read our full editorial: AI code ships with more flaws, exposing the AppSec velocity gap
