AI-generated code risk: are your AppSec controls keeping up?

TL;DR: Benchmark testing across 18 leading generative AI models found every model struggled to generate secure code consistently, with vulnerable code appearing in over 30% of atomic use-case scenarios and some blind spots failing 100% of the time, according to Armis. The result is a shift from scanner management to contextual risk management, because AI-native development now creates security debt faster than conventional AppSec can triage it.

Editorial analysis by NHI Mgmt Group, based on content published by Armis: “Beyond the Scanner: Why AI-Native AppSec Must Evolve into Risk Management”.

By the numbers:

• Armis found vulnerable code in over 30% of atomic use-case scenarios.
• The benchmark identified CWE-770, allocation of resources without limits, as the most frequent vulnerability across all models.

Key questions

Q: How should security teams govern AI-generated code in production environments?

A: Security teams should treat AI-generated code as normal production code with extra provenance risk.

Q: What are the best practices for reducing AppSec tool sprawl in AI-native development?

A: Start by defining a single prioritisation model that ranks findings by exploitability, reachability, and business impact.

Q: What breaks when AppSec teams keep using separate scanners without shared context?

A: They get overlapping findings, inconsistent severity scoring, and manual triage overhead that masks which issues are actually reachable or exploitable.

Practitioner guidance

• Prioritise AI-generated code by production reachability Rank findings by whether the vulnerable path is reachable in production and tied to business-critical workflows, not by scanner output alone.
• Add security-specific gates for AI-assisted delivery Require AI-native scanning and policy checks before code can move from development into production-bound branches or release candidates.
• Verify fixes with an independent second pass Use a separate validation step after remediation to confirm the original flaw is closed and the change did not introduce a new weakness.

Bottom line: AI-native development is creating a risk-management problem, not just a code-quality problem, because insecure patterns can be produced faster than teams can review them.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →