Topic starter
02/08/2026 12:27 pm
TL;DR: Forty-five percent of AI-generated code contains security flaws, according to Veracode. Its analysis across 80 coding tasks found only 55% of outputs were secure, with cross-site scripting and log injection among the weakest areas. The finding confirms that speed gains from AI coding tools do not remove AppSec review requirements and can expand security debt.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “AI-Generated Code: A Double-Edged Sword for Developers”.
By the numbers:
- 45% of AI-generated code contains security flaws, according to Veracode.
- Only 55% of AI-generated code was secure across 80 coding tasks, according to Veracode.
Key questions
Q: How should security teams manage AppSec when AI is writing code faster than humans can review it?
A: Teams should shift from discovery-centric reporting to remediation-centric governance.
Q: Why does AI-generated code create more technical debt so quickly?
A: AI increases output volume and repetition, so insecure patterns can spread before teams notice them.
Q: What are the signs that AI-generated code is overwhelming controls?
A: Common signals include larger pull requests, rising review time, more duplicated code, more debugging effort, and a growing gap between feature velocity and code quality.
Practitioner guidance
- Embed SAST at the point of generation Scan AI-generated code in the IDE and CI pipeline before merge so insecure patterns are blocked while the developer still has context.
- Add DAST to validate runtime behaviour Test running applications for injection, session, and output-handling flaws that static analysis can miss in generated code paths.
- Inspect third-party dependencies from generated code Review dependency manifests for typosquatting, non-existent packages, and unsafe libraries that AI tools may introduce into builds.
Bottom line: AI-generated code is not just a productivity issue, because insecure output can scale faster than teams can review it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:25 pm
AI-generated code is creating application risk faster than most AppSec programmes can absorb it. The core problem is not novelty, but throughput: insecure patterns can now be produced at the same speed as functional code. That means review capacity, not just developer skill, becomes the limiting control. AppSec teams need to treat generation volume as a governance issue, not only a developer enablement issue.
A few things that frame the scale:
- Companies are dedicating an average of 32.4% of their security budgets to secrets management and code security, with US organisations leading at 40.8%, according to the State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should organisations govern AI tools that analyse source code?
A: Set evidence thresholds, require secondary validation for high-impact findings, and define who owns the final decision. Governance should cover prompt scope, output format, reviewer sign-off, and auditability. That keeps AI in an advisory role and prevents noisy model output from becoming an unreviewed security decision.
👉 Read our full editorial: AI-generated code is widening application security risk at scale