Companies Must Prove AI-Written Software Is Safe Before Shipping

AI-Driven Rush Leaves More Defects in Production, Experts Say; New Discipline Urged to Match Verification Speed With Development Pace

Software teams are shipping far more code than before because of AI, but independent reviews show security failures have not dropped — they’ve stayed roughly the same. That means a larger volume of imperfect code is making it into customer-facing systems. Executives and boards should treat that gap between build speed and verification as an immediate business risk and adopt a stricter release discipline that can demonstrate, in real time, that a new version does what it’s supposed to and resists active attacks.

Multiple audits and industry research point to a simple arithmetic problem: if the rate of security defects does not fall but the amount of code released rises, the absolute number of vulnerabilities climbs. Investigators who analyzed vast codebases report teams have leaned heavily on copy-and-paste patterns as AI tools spread, while routine cleanup work and refactoring have declined. Internal studies from large platform operators find a correlation between heavier AI use and less predictable releases. A cybersecurity practitioner I spoke with put it bluntly: faster delivery has become the expectation, not a competitive edge — and safety hasn’t kept pace.

The remedy isn’t merely another scanner or test suite. It’s a change in how teams define “done.” I propose framing this as a formal release-assurance discipline that demands continuous evidence: automated checks that evolve with generated code, validation that ties pre-release findings to live-system behavior, and a named human accountable for the go/no-go decision. In short, you should be able to show, at the moment of deployment, that the release fulfills business requirements and would withstand probing from an attacker using automated tools.

Start small and practical — you don’t need a corporate overhaul. First, make sure verification runs at the same cadence as development: if AI produces a large share of new code, automated tests and code reviews should be produced and refreshed by the same processes, rather than bottlenecking on a shrinking set of senior engineers. Second, collapse the barrier between staging and production insight: feed runtime telemetry back into the testing pipeline so signals seen in the wild inform future checks. Third, keep responsibility clear: automate the work, but assign a person who can explain what shipped, why it was deemed acceptable and how the team would detect a failure. Regulators and boards will want a human answer after an incident, not “the agent did it.”

There are concrete controls organizations can deploy now: integrate continuous adversary-style testing that mimics how automated attackers operate; require evidence artifacts in your CI gates tying releases to test outcomes; and make refactoring and technical debt reduction part of the release criteria, not a deferred task. Security leaders I’ve talked with recommend coupling conventional unit and integration testing with adversarial fuzzing and live-monitoring hooks that map anomalies back to recent changes. When teams adopt these practices, release stability improves even as velocity remains high.

The urgency is real. Last September, an operation linked to a nation-state aimed an automated coding agent at about 30 companies, including several large banks, and let it operate largely on its own. The reporting firm said the tool did most of the work — roughly four-fifths to nine-tenths — locating weak points, composing exploits and extracting data faster than a human offensive team could. Several targets were compromised, and the attackers spent little active time once the agent was unleashed.

Boards should start asking the obvious question before the next deployment: can we prove, right now, that this release is not an attacker’s entry point? If the honest answer is no, that gap is the company’s biggest visible risk. Speed no longer buys you safety; companies that will endure are those that can stand behind what they ship, at the pace they ship it.