Why AI coding is widening the software security gap

AI coding assistants are no longer experimental.

In organizations that have adopted them, AI is responsible for roughly half of committed code.

The question is, therefore, no longer whether developers will use AI, but whether security programs can govern what those systems produce.

AI-generated code is remarkably good at producing syntactically correct code, with a 99.9% pass rate.

In contrast, security performance tells a very different story.

As it stands, the average security pass rate is only 56%, meaning roughly 44% of tested code-generation tasks introduce a known vulnerability.

As the volume of AI-generated code increases while security performance remains largely unchanged, organizations risk introducing more vulnerable code into their development environments.

As a result, software vulnerabilities are now the top breach entry point at 31%, overtaking stolen credentials.

Closing that gap means rethinking how security fits into AI-assisted development.

Organizations need to make security part of the development process from the start, choose models with risk in mind and verify code in context before it reaches production.

The goal is not to slow developers down; it’s to make sure security can operate at the same speed and scale as the software being created.

Model choice is a security decision AI models learn from enormous volumes of historical and publicly available code, including examples from open-source projects and developer communities.

That training data contains secure implementations, but it also contains outdated libraries, weak validation and insecure coding patterns.

While models are designed to produce useful, functional code, without the right controls they can reproduce those insecure patterns at scale.