{
  "id": 3465853,
  "title": "AI Can Generate Your Infrastructure. Can Your CI/CD Pipeline Trust It?",
  "url": "https://urgent.news/2026/08/26/ai-can-generate-your-infrastructure-can-your-ci-cd-pipeline-trust-it",
  "topic": "ai",
  "section": "AI",
  "published": "2026-08-26T08:34:38.000Z",
  "source": {
    "name": "DevOps.com",
    "slug": "devops-com",
    "url": "https://devops.com/ai-can-generate-your-infrastructure-can-your-ci-cd-pipeline-trust-it/"
  },
  "original_language": "en",
  "account": "A recent study by IOActive found that AI-generated code, particularly infrastructure as code (IaC) such as Terraform and Kubernetes manifests, is significantly less secure than average application code. In fact, the average security performance across 27 leading AI models was only 59%, with nearly a third of generated samples being fully exploitable. This gap in security review is becoming a real risk in production environments, as evidenced by a growing public CVE record. While AI coding assistants are useful, they are not designed to catch specific security failure modes that CI/CD pipelines were not built to handle. This means that platform teams need to close this gap without slowing down their teams. The study reveals that deployment infrastructure, including containers, CI/CD configuration, and serverless definitions, is 57.5% more vulnerable on average than general application code. Dockerfiles were particularly problematic, with close to universal failure. The issue is not just about the models producing correct, runnable code, but also about their ability to generate code that is safe to run, especially when cryptography and infrastructure logic are involved. This lack of security awareness in AI training data is a significant problem. Veracode's research also shows that only about 55% of AI code-generation tasks produce secure code out of the box, a number that has barely moved in two years despite syntax correctness climbing past 95%. This highlights a critical problem: while models are getting better at writing code that compiles and runs, they are not meaningfully improving in writing code that is safe to run. The real-world impact of this issue is evident in CVEs traced back to AI-generated code. Georgia Tech's Systems Software & Security Lab's Vibe Security Radar project has confirmed 74 CVEs directly attributable to AI-generated code across various AI coding tools in just three months, with the number of AI-linked vulnerabilities likely being 5-10 times higher due to lack of metadata trails. Additionally, Wiz's scan of AI-assisted applications revealed exposed secrets and credentials baked directly into shipped code and configuration, indicating a systemic pattern in how these tools are used. To address these issues, platform teams should treat AI-authored infrastructure changes as higher-risk by default, implementing more automated scrutiny before a human ever sees them. This approach aligns with the new reality where AI agents can draft entire Terraform modules, Kubernetes RBAC policies, and pipeline definitions in a single pass, faster than any human reviewer can evaluate them line by line.",
  "summary": "AI-generated infrastructure code is exposing a growing security gap, pushing platform teams to add stronger automated gates, provenance tracking and human review before Terraform, Kubernetes and CI/CD changes reach production.",
  "key_points": [
    "AI-generated IaC code is 59% less secure than average application code.",
    "57.5% of deployment infrastructure is more vulnerable than general application code.",
    "Only 55% of AI code-generation tasks produce secure code out of the box."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}