{
  "id": 15593780,
  "title": "Why AI coding is widening the software security gap",
  "url": "https://urgent.news/2026/10/19/why-ai-coding-is-widening-the-software-security-gap",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-19T10:00:56.000Z",
  "source": {
    "name": "TechRadar",
    "slug": "techradar",
    "url": "https://www.techradar.com/pro/why-ai-coding-is-widening-the-software-security-gap"
  },
  "original_language": "en",
  "account": "AI coding assistants are now commonplace in modern software development, with roughly half of the committed code originating from AI systems. This has raised a critical question: can security programs keep up with governing the output of these powerful tools? AI-generated code demonstrates impressive proficiency in producing syntactically correct code, boasting a 99.9% pass rate. However, when it comes to security, the numbers paint a significantly different picture. Security performance rates are far lower, averaging only 56%, indicating that nearly half of AI-generated code carries known vulnerabilities. As organizations adopt more AI-generated code at a rapid pace, the risk of introducing these weaknesses into their development environments grows. Software vulnerabilities have now become the leading breach entry point, surpassing stolen credentials and accounting for 31% of security incidents. To address this widening security gap, organizations must rethink how security integrates into AI-assisted development processes. Implementing security measures from the outset, selecting models that prioritize risk awareness, and thoroughly verifying code within its application context before deployment are crucial steps. The goal is not to hinder developers' productivity but to ensure security can keep pace with the speed and scale of AI-driven development. Model choice constitutes a crucial security decision, as AI models draw from vast repositories of historical and public code, including both secure implementations and insecure patterns. Without proper controls, models may inadvertently reproduce these vulnerabilities. Organizations cannot control all data sources used to train models but can select models that meet stringent security standards. The most secure model achieved a 68% security pass rate, while the rest ranged from 50% to 53%. It is essential to understand that security must be embedded within the software development lifecycle, encompassing static analysis, enforceable security policies, and comprehensive testing. AI-generated code may pass functional tests, but this does not guarantee security. Developers often accept outputs without fully comprehending their behavior within the application, leading to misplaced confidence due to time constraints. The effectiveness of AI-generated code varies significantly depending on the type of vulnerability. While models exhibit high success rates in detecting SQL injection (83%) and insecure cryptographic algorithms (87%), they fall short in identifying cross-site scripting (15%) and log injection (12%) vulnerabilities. Contextual verification is necessary to uncover these hidden weaknesses, as they often depend on intricate data flows, authorization mechanisms, trust boundaries, and application interactions. AI-native analysis plays a vital role in identifying contextual risk, surfacing issues such as logic flaws and broken authentication directly in pull requests. However, verifying code in isolation is insufficient; it must be integrated into the workflow and the application context. Prioritizing risks over mere findings is paramount. As AI accelerates software development, security teams face an increased burden of assessing, prioritizing, and remediating risks. This escalating pressure heightens the risk of accumulating security debt, which affects 82% of organizations and 60% for critical vulnerabilities. The growing backlog of unresolved issues makes it increasingly challenging to mitigate known risks efficiently. To manage this challenge, teams must focus on exploitable business impact, application criticality, and potential harm. AI-powered remediation tools can assist in proposing fixes within the development environment, alleviating the burden of repetitive manual work. However, these fixes must undergo thorough testing, validation, and regression checks to ensure their effectiveness. Ultimately, the objective should be to minimize meaningful exposure rather than simply augment the volume of findings or fixes. Leaders must adapt the software operating model to account for AI-assisted code, understanding its entry points, evaluating models against security requirements, integrating verification into developer workflows, and concentrating remediation efforts on exploitable business risks. Maintaining documentation of testing, fixes, and accepted risks is crucial for accountability and continuous improvement. The organizations that thrive will not be those that slow down AI adoption but those that evolve their development practices to ensure security can keep pace with the rapid pace of software creation. AI streamlines the process of generating functional code, but the true challenge lies in proving its security before deployment. The data-driven narrative concludes by highlighting the best endpoint protection software to fortify the software development ecosystem against emerging threats.",
  "summary": "How organizations can utilize AI code while still maintaining their security.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}