Topic starter
02/08/2026 12:25 pm
TL;DR: AI-assisted development is accelerating code output, but IDC and BaxBench findings cited by Checkmarx show limited scrutiny, with up to 70% of AI-generated code evaluating as insecure or flawed against secure coding baselines. The governance problem is that code generation and code review are being conflated, creating a separation-of-duties failure inside the software delivery pipeline.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “Why an AI Code Generator Can’t Secure Its Own Code. And Why Checkmarx Assist Can.”.
By the numbers:
- Developers using GenAI tools achieve a 35% productivity boost, often matching the output of 3 to 5 engineers.
- Up to 70% of AI-generated code was found to be insecure or flawed when evaluated using secure coding baselines.
- By 2028, 90% of enterprise engineers are projected to use GenAI tools.
Key questions
Q: What breaks when AI-generated code is treated like normal developer output?
A: Teams can miss insecure patterns, risky dependencies, and hidden assumptions because the review process assumes human authorship.
Q: Why do AI-generated code changes increase application security risk?
A: AI-generated code can increase risk because it accelerates output faster than review, testing, and secret hygiene can keep up.
Q: How should security teams secure AI-assisted development without overwhelming AppSec workflows?
A: Start with continuous discovery, then connect findings to exposure, criticality, and data sensitivity before remediation begins.
Practitioner guidance
- Define an independent pre-merge security gate Require a separate approval path for AI-assisted changes so the code author and the security approver are not the same control point.
- Scan AI-generated changes for secrets and unsafe dependencies Run automated checks before merge for embedded credentials, suspicious packages, and license issues because AI output often enters the repo unchecked.
- Measure AI-assisted code quality against secure baselines Track insecure findings, remediation rework, and flaw rates on AI-produced code separately from human-authored code so the risk profile is visible.
Bottom line: AI-assisted coding is creating a review gap because code generation and code validation are being conflated inside the same workflow.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:24 pm
Vibe coding creates a governance gap, not just a coding-style shift. The core problem is that code generation and code approval are being merged into one accelerated workflow, which weakens separation of duties. That matters because security review is supposed to be independent of the person or tool producing the change. Practitioners should treat the review gap as a control design failure, not a developer productivity issue.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations let the same workflow generate code and sign off on it?
A: No. Code generation and code approval should remain separate because the first task creates the change and the second task verifies it. When those duties collapse into one workflow, the organisation loses the independence needed to catch insecure code before it reaches shared systems or production.
👉 Read our full editorial: Vibe coding is exposing an AppSec review gap in AI-assisted code