Notifications
Clear all
Topic starter
19/08/2026 3:54 pm
TL;DR: AI-assisted developers produced 3 to 4 times more commits, generated 10 times more security findings, and exposed cloud credentials nearly twice as often as non-AI peers in Apiiro’s analysis of Fortune 50 codebases, indicating that productivity gains are being matched by a much larger security burden. The governance problem is not code generation itself, but the breakdown of review, design, and secret-handling controls as AI expands change volume and blast radius.
NHIMG editorial — based on content published by Apiiro: Every CEO Is Mandating AI Coding. Few Realize They’re Mandating Risk Too. Here’s the Data to Prove It
By the numbers:
- AI-assisted teams shipped 10 times more security findings.
Questions worth separating out
Q: How should security teams handle secrets in AI-generated code?
A: Security teams should treat AI-generated code as another source of credential exposure, not as a special case.
Q: Why does AI-assisted development increase security risk even when syntax errors fall?
A: Because the risk shifts from obvious mistakes to structural failures.
Q: How should security teams handle exposed secrets in AI-driven environments?
A: Security teams should treat exposed secrets as active access paths and respond as though misuse can begin immediately.
Practitioner guidance
- Score pull requests for change density Add review thresholds for AI-generated pull requests that consider files touched, services affected, and privilege-sensitive paths, not only lines added.
- Treat leaked secrets as NHI incidents Route AI-generated cloud keys, service principals, and API tokens into the same ownership, rotation, and revocation workflow used for non-human identities.
- Add context-aware security analysis to AI code review Use analysis that understands application architecture, trust boundaries, and policy dependencies so that design flaws are flagged before merge.
What's in the full report
Apiiro's full analysis covers the operational detail this post intentionally leaves for the source:
- Repository-level examples of how AI-generated changes expanded pull request scope across services.
- Methodology details on how Deep Code Analysis identified privilege escalation paths and exposed secrets.
- The underlying code patterns behind the Azure Service Principal and Storage Access Key exposures.
- How the research team separated shallow syntax improvement from deeper architectural risk.
👉 Read Apiiro's analysis of AI coding assistants and application security risk →
AI-generated code risk is rising faster than review can keep up?
Explore further
19/08/2026 4:31 pm
AI coding governance has become an identity problem as much as an AppSec problem. The article shows that AI-generated code is increasingly where secrets, service principals, and authorisation logic are introduced into the software supply chain. That means application security teams cannot treat these as isolated code defects, because they directly affect the lifecycle of non-human identities. The practitioner conclusion is straightforward: AI coding controls must extend into NHI governance.
A question worth separating out:
Q: How can organisations prove their AI controls are actually working?
A: Look for evidence that policy decisions are logged, sensitive prompts are being redacted or blocked when required, and approved AI interactions are traceable by identity and business context. Effective programmes produce audit-ready records, not just policy text. If the control cannot explain what happened in a session, it is not operational enough.
👉 Read our full editorial: AI coding adoption is scaling appsec risk faster than review
