According to developer analytics firm DX, AI now writes roughly half of all committed code, a figure that would have sounded absurd three years ago.
Security researchers have been testing that code, and the results aren’t good. Veracode’s October 2026 update found AI models still failed its security tests about 38% of the time, and in April IOActive published a whitepaper showing nearly a third of the AI-generated samples it looked at were fully exploitable.
Someone, somewhere, is approving all of this.
JD Raimondi, who leads AI architecture at software consultancy Making Sense, calls the process “approval theater,” and the company’s description of it is about as unglamorous as you’d expect.
“A developer reviews AI-generated code without understanding every decision behind it. The code runs, so it gets approved.” Making Sense, November 2026
On paper, there was a review. What actually happened is that someone checked the thing ran and moved on to the next ticket.
Developers think they’re faster than they are
The whole pitch for AI coding tools is speed, and it’s worth asking how solid that pitch is.
In early 2025, the AI research nonprofit METR put it to a randomized controlled trial. Sixteen experienced open-source developers worked through 246 real tasks on projects they knew well, mostly using Cursor Pro and Claude Sonnet.
They went in expecting AI to make them 24% faster. With the tools switched on, they took 19% longer, and they accepted fewer than 44% of the code the AI generated.
The strangest part came after. Even with the results in front of them, participants still believed AI had sped them up.
That’s a problem for code review, because a team that feels fast doesn’t stop to read things. In Stack Overflow’s 2026 Developer Survey, 48% of developers said they trust AI output only when they can easily verify it, and just 6.6% would rely on it for important work decisions. Good instincts, in theory. But checking takes time, the tools were bought to save time, and in most teams the review is what gets squeezed.
Scanners can’t see a bad permission
The usual response from security teams has been to scan AI-written code more aggressively, which catches plenty, just not the failures Making Sense worries about most.
Duplicate code and missing tests turn up constantly, and they’re annoying, but a team can clean them up. The company’s concern is an AI agent that has far more access than its task needs. It can run without a hiccup for weeks, and then one wrong command takes out production data. Because the code looks perfectly normal, there’s nothing for a scanner to catch.
Jason Lemkin found this out in July 2025. The SaaStr founder was about nine days into a 12-day experiment with Replit’s AI agent when it deleted his live production database during a code freeze, despite being told more than once not to change anything. The database held records on more than 1,200 executives.
Security practitioners seem to have absorbed the lesson. When OWASP released its 2026 Top 10 for LLM applications, it moved “excessive agency” (AI systems with more power than they should have) from sixth place to third, in the first edition built partly on real incident data.
You can’t fire a model
AI has changed who writes the code. Who gets blamed when it breaks hasn’t changed at all.
A model doesn’t sit in the post-incident meeting, and a board can’t dismiss it. People are still on the hook, and if nobody on the team really read the code, it’s hard to say anyone owned it in the first place.
This tends to surface at the worst time, usually when a customer is on the phone and nobody can explain who approved the change or why an agent had access to that table. At that point it’s a business problem, whatever it started as.
Federal regulators haven’t stepped in to settle any of this. NIST launched an AI Agent Standards Initiative in February but hasn’t finished a standard, and CISA’s agentic AI guidance, which tells companies to keep AI systems away from sensitive data and critical infrastructure, is voluntary. So each engineering team decides for itself how much an agent can touch and how carefully its work gets read, and plenty of them have never actually made that decision.
Raimondi and his colleague Mariano Jurich plan to press CTOs on exactly that in a free webinar on November 16, walking through how to tell recoverable risks from severe ones and how to audit what agents can reach before something goes wrong.
Featured image: Daniil Komov via Unsplash+
Disclosure: This article mentions a client of an Espacio portfolio company.
