Notifications
Clear all
Topic starter
02/08/2026 12:27 pm
TL;DR: Forty-five percent of AI-generated code contains security flaws, according to Veracode. Its analysis across 80 coding tasks found only 55% of outputs were secure, with cross-site scripting and log injection among the weakest areas. The finding confirms that speed gains from AI coding tools do not remove AppSec review requirements and can expand security debt.
NHIMG editorial — based on content published by Veracode: AI-Generated Code: A Double-Edged Sword for Developers
By the numbers:
- 45% of AI-generated code contains security flaws.
- 97% of developers have used AI tools.
- Only 55% of AI-generated code was secure.
Questions worth separating out
Q: How should security teams govern AI-generated code in production environments?
A: Security teams should treat AI-generated code as normal production code with extra provenance risk.
Q: Why do AI coding assistants create security debt even when code compiles?
A: Because compilation only proves syntax, not safety.
Q: What do security teams get wrong about AI-generated code risk?
A: They often focus on catching insecure output after code is written, which is too late for AI-native workflows.
Practitioner guidance
- Scan AI-generated code before merge Integrate SAST into pull request workflows so generated code is checked before it reaches main branches or release candidates.
- Test running applications for runtime flaws Use DAST to catch injection, output handling, and behavioural issues that static analysis may miss once the application is executing.
- Validate every suggested dependency Apply software composition analysis and package allowlisting so AI tools cannot silently introduce vulnerable or non-existent libraries into builds.
What's in the full report
Veracode's full article covers the operational detail this post intentionally leaves for the source:
- The full breakdown of vulnerability patterns across SQL injection, cryptographic failures, cross-site scripting, and log injection.
- The remediation workflow for integrating SAST, DAST, and software composition analysis into AI-assisted development pipelines.
- The developer behaviour and workflow guidance for reviewing generated code without slowing release velocity.
- The case-study detail behind Veracode Fix, including how the vendor describes remediation timing and developer acceptance.
👉 Read Veracode's analysis of AI-generated code security risks →
AI-generated code security flaws: what do AppSec teams need to do?
Explore further
02/08/2026 1:25 pm
AI-generated code is becoming an application security governance problem, not just a developer productivity issue. When nearly half of generated code contains flaws, the question shifts from whether AI helps teams move faster to whether review and control systems can keep pace. AppSec, IAM, and platform teams need joint ownership because insecure code often becomes the entry point for credential abuse, unsafe trust decisions, and secret exposure.
A question worth separating out:
Q: How can organisations reduce risk from AI tools without banning them?
A: Organisations can reduce risk by approving specific tools, limiting the data classes they may access, and enforcing scope restrictions for high-risk integrations. That approach supports productivity while keeping sensitive data out of unmanaged systems. The objective is controlled enablement, not unrestricted adoption.
👉 Read our full editorial: AI-generated code is widening application security risk at scale
