AI coding assistants and agents are now part of how most software is built. Google’s chief executive said in April 2026 that 75% of new code at Google is AI-generated and approved by engineers. In the 2025 Stack Overflow survey, 84% of developers said they used or planned to use AI tools, while 46% said they distrusted their accuracy.

Speed is the benefit. The question for engineering leaders is what the code costs in security, and how to keep that cost down without slowing teams back to where they were.

What the research says about AI-written code

It is often insecure. Veracode tests models on coding tasks where a secure and an insecure answer are both possible. In its 2026 report, the average security pass rate was 56%, up from 55% a year earlier, so about 44% of tasks still introduced a vulnerability, even though the code almost always compiled. Models handled cryptography and SQL injection reasonably well, but passed only 15% of cross-site scripting tasks and 12% of log injection tasks.

Real-world rates are lower, but not low. A 2025 study of 7,703 AI-attributed files on public GitHub found that about 12% contained a known class of weakness. That is better than benchmark results, likely in part because people review and edit code before committing it, but it is still roughly one file in eight.

More code means more findings. Research by Apiiro across large enterprise codebases, reported by The Register in September 2025, found that developers using AI assistants produced three to four times more code and ten times more security findings. Syntax errors fell while privilege-escalation paths and design flaws rose.

Access control is the weak spot. GitHub’s Octoverse 2025 report found broken access control overtook injection as the most common code-scanning alert, and linked part of the rise to AI-generated endpoints that lack authorisation checks.

Five risks to manage

1. Insecure patterns that look correct

AI-generated code is fluent. It follows conventions, has tidy comments and passes the tests it was asked to pass. Missing output encoding, missing permission checks and over-broad database queries are easy to miss in review because nothing looks wrong.

2. Secrets in code and configuration

GitGuardian found 28.65 million new secrets exposed on public GitHub in 2025, up 34%, and secrets for AI services up 81%. It also found more than 24,000 unique secrets in configuration files for MCP, the protocol that connects AI assistants to tools. Assistants readily paste keys into code when asked to “just make it work”.

3. Packages that do not exist

Large language models sometimes recommend packages that were never published. In research presented at USENIX Security 2025, 19.7% of the packages suggested across 576,000 generated code samples did not exist (about 5% for commercial models and 22% for open-source ones), and 43% of those made-up names came back every time the same prompt was repeated. That predictability lets attackers register the names in advance, a technique called slopsquatting.

It is not hypothetical. A security researcher registered one commonly hallucinated Python package name as an empty placeholder in 2024, and it was downloaded more than 30,000 times in three months.

4. The coding tools are now targets

Attackers have noticed that AI assistants run with a developer’s access to code, secrets and the terminal.

  • Poisoned instructions. In 2025, researchers showed that hidden Unicode characters in an assistant’s rules file could steer GitHub Copilot and Cursor into writing malicious code without the developer noticing.
  • Malware that uses your AI tools. In August 2025, malicious versions of the Nx build package used AI command-line tools installed on developers’ machines to search for secrets. The campaign exposed 2,180 GitHub accounts.
  • Worms that plant AI hooks. In August 2026, a self-spreading npm worm poisoned, by one count, 1,684 versions across 420 packages. It planted a start-up hook for an AI coding assistant and an editor task that runs when a project is opened, so a developer could be compromised just by opening a repository.
  • Flaws in the tools themselves. Serious flaws, many triggered by prompt injection or malicious project files, have been found and fixed in widely used tools, including Cursor (CVE-2025-54135 and CVE-2025-54136), GitHub Copilot in VS Code (CVE-2025-53773) and Claude Code (CVE-2025-59536). In the popular mcp-remote package, a malicious server could trigger command execution on the developer’s machine (CVE-2025-6514, rated 9.6 out of 10).

5. Trusted signals can fail

Two incidents in 2026 show why no single control is enough. The malicious release at the start of the npm worm carried valid npm provenance, the signal meant to prove where a package was built. And in March 2026 the popular open-source scanner Trivy was compromised: between 19 and 23 March, in windows of a few hours each, malicious versions of the tool and of 76 of its 77 GitHub Action tags were served to the pipelines that used them to check their own security.

A guardrail pipeline that works

The goal is not to stop teams using AI. It is to put the same automated checks between AI output and production that you would want for any fast-moving team, and to concentrate human review where it matters.

  1. Configure the assistants. Treat rules files and assistant settings as code: review changes to them, and check for hidden characters. Restrict which MCP servers and tools an agent may use, never let it auto-approve its own actions, and keep it away from production credentials.
  2. Stop secrets before they are committed. Run a secret scanner such as Gitleaks as a pre-commit hook and again in CI. Rotate anything that leaks.
  3. Scan every pull request. Use static analysis such as Semgrep Community Edition or CodeQL, dependency checks such as OSV-Scanner, and infrastructure-as-code checks such as Checkov. Block merges on high-severity findings.
  4. Verify packages before they are installed. Check that new dependencies exist, are established and are the ones intended. Free tools such as Socket Firewall can block known-malicious packages at install time.
  5. Pin your pipeline. Pin CI actions and tools to full commit hashes rather than version tags, which is the main advice from the Trivy incident, and generate a software bill of materials (for example with Syft) for each release.
  6. Put a person on the risky changes. Require human review for changes touching authentication, authorisation, payments, data access and infrastructure. AI-assisted review can help reviewers, but should not be the final word.
  7. Write it down. Map the pipeline to the NIST Secure Software Development Framework and its generative AI profile (SP 800-218A). The OpenSSF’s guide to secure instructions for AI code assistants is a practical companion.

This matters for compliance as well as security. Since 11 September 2026, manufacturers of software products sold in the EU must report actively exploited vulnerabilities under the Cyber Resilience Act, and its main obligations apply from 11 December 2027. A documented pipeline is the evidence customers and regulators will ask for.

Mirawyn’s AI code assurance pipeline builds this for your stack using open-source tools first, with commercial options where they are worth it. If you are choosing tools, security tool advisory tests the options against your environment before you buy.

Sources

  • Fast Company, Google says 75% of its new code is AI-generated, 23 April 2026. fastcompany.com
  • Stack Overflow Developer Survey 2025, AI section. survey.stackoverflow.co
  • Veracode, 2026 GenAI Code Security Report, 28 July 2026. veracode.com
  • Schreiber and Tippe, security weaknesses in AI-attributed code on GitHub, arXiv, October 2025. arxiv.org
  • The Register, Apiiro research on AI coding assistants, 5 September 2025. theregister.com
  • GitHub, Octoverse 2025, 28 October 2025. github.blog
  • GitGuardian, State of Secrets Sprawl 2026. gitguardian.com
  • Spracklen et al., “We Have a Package for You!”, USENIX Security 2025. usenix.org
  • ITPro, hallucinated package downloaded by enterprises, 2 April 2024. itpro.com
  • Pillar Security, Rules File Backdoor research, 18 March 2025. pillar.security
  • BleepingComputer, s1ngularity attack on Nx, 6 September 2025. bleepingcomputer.com
  • The Hacker News, npm worm poisons hundreds of packages, 4 August 2026. thehackernews.com
  • Snyk, analysis of the keyv npm compromise and its provenance, August 2026. snyk.io
  • Check Point Research, Claude Code project-file vulnerabilities, 25 February 2026. research.checkpoint.com
  • Embrace The Red, GitHub Copilot remote code execution via prompt injection, 12 August 2025. embracethered.com
  • Security Boulevard, Cursor CVE-2025-54135 and CVE-2025-54136, August 2025. securityboulevard.com
  • JFrog, CVE-2025-6514 in mcp-remote, 9 July 2025. jfrog.com
  • Aqua Security, Trivy security advisory GHSA-69fq-xp46-6x23, March 2026. github.com
  • NIST SP 800-218A, secure software development practices for generative AI, July 2024. csrc.nist.gov
  • OpenSSF, Security-Focused Guide for AI Code Assistant Instructions, August 2025. best.openssf.org
  • European Commission, Cyber Resilience Act reporting obligations take effect, 11 September 2026. commission.europa.eu