Overview
- Security programs are moving checks into IDEs and CI pipelines, with governance on approved tools and data use to stop bad AI code before review.
- Teams report more pull requests and larger changes, and analyses find unused code, hardcoded values, and higher‑risk bugs such as hardcoded values and weak auth in AI output.
- Experiments show reviewers give AI‑generated pull requests less pushback when the code looks polished or repeats patterns, creating a blind spot.
- Automated scans catch only part of AI mistakes, with studies citing roughly 20–25% detectable and many errors left unseen, so human review remains essential and triage should focus on real exposure.
- Large firms responded by adding upstream automation, as Google invested in verification for LLM‑driven changes and Uber built a pre‑review system to ease reviewer load.