AI-Generated Code: Facing New Cybersecurity Challenges

AI-powered assistants have become an essential component of software development today. In organizations that actively utilise this technology, approximately half of all code is generated by artificial intelligence. While these systems produce syntactically correct code with 99.9% accuracy, the security outlook is far more concerning. Research indicates that the security rating of AI-generated code is only 56%, meaning every second task contains a potential vulnerability.

Model selection as a security strategy

AI models are trained on vast datasets that include both modern and outdated, insecure software code. Consequently, a model can inadvertently replicate incorrect and vulnerable structures. It is important to note that different models have varying security performance. Even the best-performing models have only recorded a 68% security threshold, with most ranging between 50% and 53%. Therefore, choosing a model is not just a matter of productivity—it is directly linked to a company's cybersecurity risks.

The importance of context and vulnerability types

Code written by AI may successfully pass functional tests and appear sound, yet still contain serious flaws. Data shows that models handle issues like SQL injections relatively well (83%), but their effectiveness is catastrophically low against vulnerabilities such as Cross-site Scripting (15%) or log injections (12%). These flaws depend on data flows and the internal logic of the application, which requires context-oriented checks alongside automated ones.

Managing security debt

Organizations today are facing the problem of "security debt." This refers to discovered but uncorrected flaws that accumulate over time, making the system more vulnerable. 82% of organizations already have such debt, and 60% have debt of a critical nature. To use AI effectively, teams must change their approach: instead of treating all discovered flaws with equal priority, the focus should be on real risks and the probability of impact on the business.

Ultimately, successful companies will not slow down the adoption of AI, but will instead adapt them to modern security standards. The main goal is for security checks to be carried out during the code creation process rather than after its completion. For organizations in Georgia that are actively implementing AI solutions, this means introducing strict control mechanisms and training developers on the risks that accompany automation.