Coding with AI without code review: the security debt that keeps growing
Studies by Veracode and Stanford show that AI-generated code fails security tests in almost half of cases — and that the people who write it trust it more, not less. Without human review, that confidence becomes risk.
13 October 2026
AI-generated code has a problem that is hard to see with the naked eye: it looks finished. It compiles, the feature works, the deploy runs without errors. For a founder with no time to look closely, that's a green light.
But "it works" and "it's secure" are different things — and that is exactly where the debt piles up without anyone noticing.
AI doesn't just make more security mistakes — it convinces its users it didn't
In 2023, Stanford researchers had developers solve the same problems, some with access to an AI assistant and some without. The results, published in the study "Do Users Write More Insecure Code with AI Assistants?", showed two things:
- Those who used the assistant wrote less secure code in four of the five exercises — especially in encryption and protection against SQL injection.
- Those who used the assistant were more convinced their code was secure than those who didn't.
It's the worst possible combination: less security, more confidence. Without someone reviewing that code from the outside, that confidence is never confronted with reality — until someone exploits the flaw.
The numbers, at scale
In 2025, Veracode tested more than 100 AI models on 80 curated programming tasks and measured how many produced code with real security flaws (OWASP Top 10).
Some of the figures in the report:
| Flaw | Rate |
|---|---|
| Security flaw, on average (all languages) | 45% |
| Security flaw in Java code | 72% |
| Cross-Site Scripting (XSS) | 86% |
| Log Injection | 88% |
| Likelihood of introducing XSS vs. a human developer | 2.74x more likely |
This isn't about one bad or outdated model — the study covered more than 100 models, including the latest on the market. It's a structural pattern: AI optimises for code that works, not for code that withstands an attacker.
Where this gets expensive
None of these numbers is fatal on its own — that's what code review, security testing and human review before production are for. The problem is when that layer disappears.
Without code review, nobody is asking "where does this input come from?", "is this validating what it should?", "was this key hardcoded?". The AI doesn't ask itself those questions — and, as the Stanford study shows, the people using it tend to assume it's already handled.
The result is the same pattern we already see in other projects we inherit: software that has been "working" for months, until an incident, a GDPR audit or an investor's due diligence finds what nobody had gone to look for.
The speed AI gives you is real. So is the risk it leaves behind when nobody reviews it.
See also: Audits and fixes for AI-built apps.
Sources: Veracode — 2025 GenAI Code Security Report; Perry, Srivastava, Kumar & Boneh, Do Users Write More Insecure Code with AI Assistants?, Stanford, 2023.