AI-generated code security risks: are your controls keeping up?

AI-generated code turns application security into an identity-adjacent governance problem. The issue is not only insecure syntax or bad patterns, but the erosion of review, ownership and approval discipline around the code that defines access and data handling. When teams treat generated output as ordinary code, they miss the fact that the application is now carrying implicit security decisions made outside the normal control path. Practitioners should govern AI-assisted development as a release-risk and access-risk programme, not a productivity experiment.

A few things that frame the scale:

• Companies are dedicating an average of 32.4% of their security budgets to secrets management and code security, with US organisations leading at 40.8%, according to the State of Secrets in AppSec.
• Organisations that rely heavily on static credentials reported a 20-percentage-point increase in security incidents compared with those with low reliance, according to the 2026 Infrastructure Identity Survey.

A question worth separating out:

Q: How should organisations govern AI tools that analyse source code?

A: Set evidence thresholds, require secondary validation for high-impact findings, and define who owns the final decision. Governance should cover prompt scope, output format, reviewer sign-off, and auditability. That keeps AI in an advisory role and prevents noisy model output from becoming an unreviewed security decision.

👉 Read our full editorial: AI-generated code is exposing enterprise apps to more security risk