AI-Written Code: Why Review and Security Matter More
Two years ago, AI coding tools mostly suggested the next line of code. Today, AI agents take a task description, write the code, run the tests, and open a pull request on their own. GitHub's Octoverse 2026 report, published at the end of October, put a number on the shift: agents started more than 40 percent of pull requests in September 2026, up from 17 percent in March, amounting to around 110 million pull requests in a single month. Writing code has never been faster or cheaper. That changes where the real work in software development lies, and it raises an important question for any business that depends on software: who makes sure all this code is actually correct and secure?
What the Data Says About AI Code Quality
Modern AI models produce code that compiles and runs almost every time, but security is a different story. Veracode's 2026 GenAI Code Security Report, published in July, found that around 44 percent of AI code generation tasks introduced a risky security vulnerability in testing. The average security pass rate across models was 56 percent, barely changed from the previous year, even as the models became much better at writing functional code.
The results vary widely by type of flaw. Models handled some classic issues reasonably well, but performed poorly on others, such as cross-site scripting and log injection, where pass rates were very low. In other words, AI-generated code often looks right and works in a demo while still containing vulnerabilities that only an experienced reviewer or a proper security process would catch.
The Review Bottleneck
When code is cheap to produce, the scarce resource becomes careful review. Open-source maintainers are already feeling the pressure. In October, Ruby Central reported that reviewers rejected 120 of 134 findings from an AI security scanner, although one valid finding revealed a serious authentication bug. A Gentoo maintainer described vulnerability reports arriving at unusually high rates, much of it AI-generated, and projects such as curl have updated their disclosure policies in response.
The same dynamic applies inside companies. More code, more pull requests, and more automated findings do not automatically mean better software. Without experienced engineers reviewing architecture, security, and business logic, teams risk accumulating code that nobody fully understands, along with the security debt that comes with it.
Where AI Genuinely Helps
None of this means AI should be avoided. Used well, it is a significant productivity gain. AI tools are excellent at writing boilerplate, generating tests, explaining unfamiliar code, drafting documentation, migrating code between versions, and exploring alternative solutions quickly. Experienced developers who use AI effectively can spend less time on repetitive tasks and more time on design, edge cases, and the parts of a system where judgment matters most.
The difference lies in how AI is used. Treated as a capable assistant whose work is always reviewed, it makes good teams faster. Treated as a replacement for engineering judgment, it produces software that works until it suddenly does not.
How to Use AI Without Inheriting Its Risks
- Review every change. AI-generated code should go through the same, or stricter, review as code written by a person, with attention to security and business logic, not just style.
- Automate security checks. Static analysis, dependency scanning, and secret detection in the pipeline catch many common flaws before they reach production.
- Test what matters. Require meaningful automated tests for critical flows such as authentication, payments, and integrations, and do not accept AI-written tests that only confirm the code does what it already does.
- Keep architecture human-owned. Decisions about data models, security boundaries, and integrations should be made deliberately by experienced engineers.
- Set clear policies. Decide which AI tools may be used, what data they may access, and how their output is reviewed and approved.
- Isolate agents. Run autonomous coding agents in controlled environments with limited permissions, rather than directly on developer machines with access to production credentials.
What This Means If You Are Buying Software
For businesses that commission custom software, AI changes the questions worth asking a development partner. Speed claims are easy to make; what matters is how quality is guaranteed. Ask how AI is used in their process, who reviews AI-generated code, which security checks run automatically, how critical areas are tested, and whether you will receive code that your own team or another partner can understand and maintain. A partner that uses AI to move faster while keeping experienced engineers accountable for every line delivers the benefits without the hidden costs.
Frequently Asked Questions
How much code is written by AI today?
GitHub's Octoverse 2026 report states that AI agents started more than 40 percent of pull requests in September 2026, up from 17 percent in March. In organizations that have adopted AI coding tools, studies cited by Veracode suggest AI authors roughly half of committed code.
Is AI-generated code secure?
Not reliably. Veracode's 2026 report found that around 44 percent of AI code generation tasks introduced a risky security vulnerability in testing, with an average security pass rate of 56 percent across models. AI code needs the same security review and testing as human-written code.
Should we stop using AI coding tools?
No. AI tools offer real productivity gains for tasks such as boilerplate, tests, documentation, and migrations. The key is to combine them with experienced review, automated security checks, and clear policies.
Can AI replace code review?
AI can assist reviewers by flagging possible issues, but it cannot replace experienced judgment. Automated findings also need verification: in one recent review, 120 of 134 AI scanner findings were rejected as invalid, while one real finding exposed a serious bug.
What should we ask a software company about AI?
Ask how AI is used in their workflow, who reviews AI-generated code, which automated security and quality checks they run, how critical features are tested, what data AI tools can access, and how they ensure the delivered code is maintainable.
Does AI make custom software cheaper?
It can reduce the time spent on routine work, but the cost of design, review, testing, security, and integration remains. The most realistic benefit is faster delivery and more time spent on the parts of the system that matter most, rather than a dramatic reduction in total cost.
Conclusion
AI has made writing code dramatically faster, and agents now produce a large share of the changes on the world's largest code platform. Yet the data shows that security and correctness have not kept pace, and the burden of quality has shifted to review, testing, and engineering judgment. Businesses that benefit most from AI will be those that pair it with experienced people and solid processes. That is how we work: we use AI to move faster on routine tasks, while experienced engineers design, review, and take responsibility for every system we deliver.