You did not get 4x faster. You got 10x less secure — and now there is data

The number nobody puts on the slide

Veracode tested more than a hundred language models on security-sensitive coding tasks. The result: only 55% of generations produce secure code. In the other 45%, the model introduces a known OWASP Top 10 vulnerability.

Read that again, because the positive framing deceives. It is not "AI sometimes gets it wrong." It is: in nearly half the cases where you ask for security-sensitive code, what comes back is born with a flaw catalogued twenty years ago.

And it does not fail randomly. It fails with a pattern: 41% of AI-generated backend code ships with overly broad permissions, and the tools generate admin-level access by default, with no role restriction. The model learned from internet tutorials. Tutorials do not have access control.

4x more commits, 10x more findings

Here is the number that should have stopped the discussion in every engineering meeting this year: AI-assisted developers produce commits at three to four times the rate of their peers — and introduce security findings at ten times the rate.

Do the division. You are not trading speed for quality one for one. You are paying two to three times more risk per unit of speed gained. That is not a trade-off; it is a debt with built-in interest nobody agreed to.

And it is not a feeling. GitClear and GitKraken analyzed 623 million real code changes between 2023 and 2026. A quarter of all commits are already AI-assisted. Eight maintainability metrics degraded over the period. Code duplication rose 81% compared to the pre-AI era.

81% duplication means something very concrete: when you need to fix that rule, it lives in eight places and you will find five.

The CVEs already have birthdays

If this reads like pessimistic architect worry, look at the time series of vulnerabilities attributed directly to AI-generated code: 6 CVEs in January 2026. 15 in February. 35 in March.

That is a curve, not a point. And it is lagging by definition — a CVE is what has already been found, disclosed, and catalogued. What was written in 2025 is being exploited now.

There is more: research shows security degrades with each iteration. You ask for the code, you do not like it, you ask it to improve, you ask it to adjust — and every round comes back less secure, not more. Exactly the opposite of intuition. The loop that feels like refinement is, in security terms, erosion.

The market is already betting against you

Gartner projects an entire remediation market emerging: tools and consulting specialized in auditing, identifying, and refactoring AI-generated technical debt.

Sit with that for a second. A billion-dollar market is forming to clean up what you are writing this quarter. Cost estimates put maintenance at four times traditional levels by year two when generated code is left unmanaged.

When analysts start sizing the cleanup market, the mess is already consensus.

No, the answer is not to stop using AI

If you got here expecting "go back to writing everything by hand," this is not that piece. Agents deliver real value, and we have written here about where they win. The tool was never the problem. It is that generation speed was multiplied and verification capacity stayed exactly where it was.

You installed a jet engine in a car and kept the original brakes.

What separates those who will pay the bill from those who will not:

1. Blocking SAST in CI, today. Not "warning," not "report mode," not a dashboard nobody opens. Failing the PR. If 45% of generations carry an OWASP flaw, sampled human review is not a control — it is hope.

2. Authorization review as a mandatory checklist item. With 41% of generated backend code shipping excessive permissions, the question "who can call this, and with what scope?" needs to be written into the PR template. Every time.

3. Tests before the code, not after. A machine-verifiable criterion is the only thing that scales alongside generation. Without it you have volume without verification — the literal definition of the problem.

4. Measure duplication and complexity, not lines delivered. If your productivity metric rises while maintainability falls, your metric is measuring the damage.

5. Nobody merges what they cannot explain. Simple rule, expensive to enforce, and the only one that stops the codebase from becoming foreign territory. If the PR author cannot defend why that line exists, nobody on the team will know six months from now.

The last line

AI-generated code is not worse by nature. It is produced faster than any human verification process was ever designed to absorb — and the difference between those two sentences is the only thing deciding whether, in 2028, you are shipping product or hiring consultants to clean up 2026.

The bill arrives for everyone. Your only choice is whether you pay now, in process, or later, in incident.