AI Writes Code Faster Than Anyone Can Check It. That's the Problem.
Machine-generated code is flooding into production with fewer human eyes on it. Defenders are being asked to catch what nobody wrote by hand.
Key points
- AI coding assistants now generate large portions of production software, often skipping the review steps that used to catch security flaws.
- Security teams face a widening gap between how fast code ships and how fast it can be checked.
- Automated scanners built for human-written code frequently miss the patterns AI produces.
- Developers remain responsible for what ships, even when a model wrote the first draft.
- Security checks need to be built into AI tools from the start, not added on later.
Software used to move at the speed of a keyboard. Now it moves at the speed of a prompt.
AI coding assistants, tools that write working code from a plain-English request, have quietly become part of how most modern software gets built. A developer types what they want. The model produces a function, a class, sometimes an entire service. It works and ships.
That is the problem.
Every previous jump in developer productivity, from compilers to open-source libraries to cloud platforms, came with a matching set of security checkpoints: code reviews, static analysis (automated tools that scan code for known bug patterns), and manual testing. Each checkpoint assumed a human was slow enough to be interrupted. AI has removed the slowness without removing the bugs.
How is AI-written code actually different?
It looks fine, and that's exactly what makes it dangerous. Code from a large language model, the AI type behind tools like GitHub Copilot and Cursor, is typically syntactically clean and superficially plausible. A tired developer reading it at 4pm will nod and merge it.
The model doesn't understand the security context of the application it's writing for. It doesn't know which inputs come from untrusted users or what your authentication rules are. It happily suggests string concatenation for database queries, a classic setup for SQL injection, where an attacker sneaks commands into a form field and takes over the database. It also reuses code patterns from its training data, some of which were vulnerable when originally written.
Researchers have flagged this for a while. Studies from Stanford and NYU over the last two years found that developers using AI assistants tend to write less secure code than those working alone and, more troublingly, feel more confident about it.
Why aren't scanners catching this?
Most security scanning tools were built to find human mistakes, the sloppy shortcuts a rushed engineer takes at midnight. AI-generated code fails differently. It hallucinates library names, inventing software packages that don't exist, which attackers can register and fill with malware. It stitches together valid-looking authentication logic with a subtle hole three functions deep. It writes tests that pass because the tests came from the same model as the code.
We flagged the audit problem directly on 2 July in "AI-Generated Code Is Outpacing Your Audit Process", where CISOs described traditional software audits buckling under the pace of AI-assisted development. The failure modes have only multiplied since.
What can defenders actually do?
Treat AI output as untrusted input, the same way you'd treat data from a stranger on the internet. That means real code review, not a rubber stamp. Run security tools that understand modern AI patterns, including checks for hallucinated dependencies. Log which code came from a model and which came from a person, so you can re-examine it when a new class of AI bug surfaces.
Training matters too. Developers need to know what the models get wrong, not just what they get right. A team that has watched a Copilot suggestion quietly introduce a hardcoded credential will spot the next one. A team that hasn't looked won't.
The part that deserves more attention than it's getting: the confidence gap. Developers who feel good about AI-assisted code are less likely to scrutinise it, and that's where the real exposure sits. Speed isn't the enemy. Misplaced trust is.
The speed is not going away. Neither is the responsibility for what ships.
