Topic starter
21/08/2026 4:46 pm
TL;DR: AI-assisted development is shipping more security defects, with CodeRabbit finding 2.74× more cross-site scripting issues and 10.83 issues per pull request versus 6.45 in human-only code, while five studies collectively point to a widening gap between code generation speed and remediation capacity, according to Pixee. The practical lesson is that organisations need automated review and fix pipelines that can keep pace with AI output, not just more manual gates.
Editorial analysis by NHI Mgmt Group, based on content published by Pixee: “The 2.74× Problem: New Data Shows AI Code Ships With Nearly 3× More Security Flaws”.
By the numbers:
- Checkmarx surveyed 900 security and development professionals and found that 34% of code in enterprise repositories is now AI-generated, according to Pixee.
Key questions
Q: What breaks when AI-generated code is reviewed without security gates?
A: What breaks is the assumption that a clean-looking diff is a safe diff.
Q: Why do AI-generated pull requests need different security handling than human-written code?
A: AI-generated changes are often broader, faster and less obviously traceable than human-written edits, so the security model has to account for agent identity, generation rules and automatic reproduction of insecure patterns.
A: Measure both speed and detection quality together.
Practitioner guidance
- Add explicit review gates for validation and authorization logic Require human review on any AI-assisted change that touches input handling, object access, session handling, or password policy so context-dependent flaws are not waved through with syntactic approval alone.
- Automate fixes for repeatable AppSec defect patterns Route common flaws such as XSS, IDOR, and insecure password handling into automated detection and safe-fix workflows so the queue does not depend entirely on manual triage.
- Measure AI-assisted code separately from human-written code Track defect density, review time, and remediation latency by code origin so security leaders can see whether generated code is outpacing the organisation's ability to secure it.
Bottom line: AI-generated code is not just faster code. It is code that more often misses the contextual security decisions that keep applications safe in production.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:05 pm
AI code governance has become an application security control problem, not a developer productivity debate. The article shows that the security failure is systematic: generated code repeatedly misses context-dependent safeguards rather than merely introducing noisy bugs. That means review models built for human-paced development are now structurally behind the production rate of defects. Practitioners should treat AI-assisted coding as a governance domain with explicit control ownership.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should AppSec teams do when AI code output exceeds remediation capacity?
A: They should move predictable issues into automated remediation and reserve human reviewers for architecture-sensitive exceptions. If the queue keeps growing, the process is failing to scale with generation speed. The decision is not to stop using AI coding assistants. It is to redesign review so routine flaws are handled mechanically and scarce expertise is applied where judgment matters most.
👉 Read our full editorial: AI code ships with more flaws, exposing the AppSec velocity gap