Topic starter
18/08/2026 2:25 pm
TL;DR: AI coding tools are now mainstream, with 82% of developers using or planning to use them, but review capacity has not kept pace and insecure patterns such as hardcoded credentials and broken access control are being reproduced at scale, according to Arnica. The control problem is no longer code volume alone, but whether AppSec can treat AI-authored output as untrusted input before merge.
Editorial analysis by NHI Mgmt Group, based on content published by Arnica: “AI-Generated Code Security: The CISO Guide (July 2026)”.
By the numbers:
- 82% of developers use or plan to use AI coding tools.
Key questions
Q: What breaks when AI-generated code is reviewed without security gates?
A: What breaks is the assumption that a clean-looking diff is a safe diff.
Q: Why does AI code generation create risk even when developers trust the output?
A: Because the model optimises for plausible code, not for your threat model or secure defaults.
Q: What do security and engineering teams get wrong about AI-assisted development?
A: They often confuse faster output with better control.
Practitioner guidance
- Enforce PR-time scanning on every AI-touched file Run SAST, dependency scanning, and secrets detection on every pull request that contains AI-generated or AI-assisted changes before merge.
- Track provenance for AI-assisted code Mark files and commits that were generated or modified by AI so security teams can target re-review when a vulnerability class appears later.
- Treat AI suggestions as untrusted input Apply the same approval standard to AI-authored code that you would apply to third-party contributions, especially where the code touches authentication or secrets handling.
Bottom line: AI-generated code is creating a governance gap because insecure patterns can be reproduced faster than manual review can reliably catch them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:15 pm
AI-generated code is becoming a governance problem before it is a tooling problem. The issue is not simply that models write flawed code, but that organisations often still assume review capacity can absorb the output. That assumption fails when code volume rises faster than AppSec staffing or workflow redesign, so the control model has to move to policy enforcement at generation and merge time.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: What happens when AI agents can modify code and secrets workflows?
A: The control boundary moves from developer intent to agent authorization. If an AI agent can open pull requests, modify CI/CD, or reach secret stores, then its identity and privilege scope must be governed like any other high-risk non-human identity. Otherwise, the agent can create or propagate insecure changes without a reliable human checkpoint.
👉 Read our full editorial: AI-generated code security exposes a new AppSec governance gap