Topic starter
14/09/2026 10:10 am
TL;DR: AI-assisted teams are shipping 3 to 4 times more commits but also 10 times more security findings, according to Apiiro, as AI-generated code accelerates AppSec risk faster than human review can keep up. Prevention at the prompt level is becoming the decisive control point, because detection-heavy workflows cannot reliably stop issues before they are written into code.
Editorial analysis by NHI Mgmt Group, based on content published by Apiiro: “Half of Google's Code Is Now AI-Generated. Here's What That Means for Security Leaders.”.
By the numbers:
- More than 25% of new code at Google was being generated by AI in Q3 2024, according to Apiiro.
- By Q4 2025, that number had doubled to roughly 50%, according to Apiiro.
Key questions
A: Security teams should move controls into the development flow before code is written.
Q: Why do AI-generated code changes increase application security risk?
A: AI-generated code can increase risk because it accelerates output faster than review, testing, and secret hygiene can keep up.
Q: What breaks when application security stays reactive in AI-driven development?
A: Reactive application security breaks down when teams depend on scanning and fixing after code is already committed.
Practitioner guidance
- Embed security policy into AI coding prompts Require approved architectural and security context in every prompt that uses AI to generate application code, especially where APIs, tokens, and service credentials are involved.
- Classify AI coding systems as governance objects Assign ownership for the policies, approved patterns, and exception handling that govern code-generation workflows, rather than leaving AI assistant usage to developer discretion.
- Prioritise preventive controls over post-commit review Treat SAST, SCA, and testing as important assurance layers, but move the primary control point earlier so insecure patterns are blocked before code exists.
Bottom line: AI-generated code is forcing AppSec to shift from late-stage detection to pre-generation control because code now appears faster than human review can keep up.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:11 am
AI-generated code creates a governance problem before it creates a vulnerability problem: the security decision now happens at prompt time, not after merge. That shifts AppSec from an evidence-based review model to a policy-enforced generation model, which is a material change for enterprise control design. Security leaders should treat this as a new control plane, not a tooling tweak.
A question worth separating out:
Q: How should teams govern AI assistants that can run migrations and execute code?
A: Treat those assistants as governed non-human identities with narrowly scoped tool permissions, explicit environment boundaries, and logged execution paths. Separate code generation from runtime execution so the model cannot turn advice into action without the right context, approval, and traceability. If the assistant can touch production-like systems, it needs the same scrutiny as any other privileged automation.
👉 Read our full editorial: AI-generated code demands security controls before the first line