The Rise of Developer-Led Security in the Age of AI-Generated Code

A few years ago, writing code and securing code were two different jobs done by two different teams. That line is disappearing fast. Developers are now shipping code faster than ever, much of it written with help from AI, and increasingly, they are the ones expected to catch the security problems before anyone else even sees the pull request.

In this article, we will look at why security responsibility is shifting onto developers, how AI-generated code is changing the kinds of risks teams face, and which tools are helping developers keep up without slowing down.

Why security is landing on developers’ desks

For many years, security was an afterthought when it came to software development. A specialized team would scrutinize the codes, perform scans, and catch problems before the release. In the past, this approach worked fine, where software was developed at a pace where it was fine to perform a review after the development was complete. But this trend is changing with the entry of AI.

AI-assisted programmers today are able to generate much more code than regular programmers, and that creates challenges for the previous model of review. A study of Fortune 50 companies reveals that AI programmers make 10 times the number of security queries as regular developers, creating security debts that pile up faster than organizations can fix them. When one team has too much code to work with, something has to give.

That something is the review process as we know it today. Instead of carrying out security checks after everything else is done, security checks are now integrated into the developer’s workflow. The reasoning behind this is simple. If a significant amount of software comes from AI programs, the person using that code should be able to judge the code in real time.

How AI-generated code is changing the threat landscape

Veracode tested more than 150 different large language models via security-critical programming scenarios and discovered in recent trials that in every case, 55% of all processes produced secure code, meaning that in 45% of cases the model introduced a detected security vulnerability. Another alarming thing is that the trend is very disturbing. The correctness of syntax has increased dramatically from 50% to 95% since 2023, but the security success rate has remained constant during this period. In other words, AI has improved a lot in writing code that can be executed, but not in writing safe code.

In addition, the mistakes AI is making are quite similar from one scenario to another. Approximately 41% of the backend code generated by AI has overly broad permissions, and AI technologies often use administrator access mode without appropriate role restrictions. Misconfigured permissions for cloud computing, improper validation of input values, and old-fashioned cryptographic solutions are often found in different studies, primarily because they are trained on a lot of public code that was written long ago and thus contains a lot of insecure patterns.

There is also a newer, stranger risk. AI models sometimes invent software packages that do not actually exist, and attackers have started registering those exact package names so that anyone who blindly installs the AI’s suggestion pulls in malicious code instead. It is a small detail, but it captures something important about this moment. The vulnerabilities are not always the ones security teams have spent years training people to spot.

What developers are actually doing about it

There is hope in the fact that developers can actually make a change when it comes to protecting their code.

Perhaps the simplest solution is completely free. Simply instructing the AI assistant to prioritize secure coding would greatly improve the chances of getting safe code back instead of relying on the way the model works by default. That is a practice that every developer can start following right away without needing any special tools.

What is more, tools are improving quickly. Static analysis and software composition analysis tools are being designed to specifically search for AI code instead of treating it as traditional writing. Security platforms are putting checks inside the developer’s environment, inside the IDE and within the pull request, thus ensuring issues are detected while the code is still fresh in the developer’s mind.

Larger platforms are following the same instinct. Recent industry moves have focused on connecting real production signals, like whether a piece of code is actually exposed to the internet, with the vulnerabilities found during development, so that developers can prioritize the fixes that matter most instead of drowning in low-value alerts. The goal across the board is the same. Give developers enough context and enough automation that reviewing for security does not feel like a separate, painful step bolted onto their existing job.

None of this replaces dedicated security teams. It just changes where the first line of defense sits. Security professionals are shifting toward setting policy, building guardrails, and handling the hardest, most contextual judgment calls, while developers own the day-to-day job of catching common issues as the code is written.

Where does this leave your team

Development-led security has become the new norm and will not go away. With AI continuing to grow as part of code creation, teams adapting to this earlier will avoid burdening themselves with heavy security debt later on.

If your developers are still not analyzing AI-generated code with the same rigor that would come with a junior engineer’s first pull request, you have found the first step. Review what steps your developers have undertaken to include security in the development process and detect any possible vulnerabilities before hackers deal with them for you.