AI’s newest coding models still fail security checks close to half the time, even as those same tools turn a blank screen into a working app within hours. Veracode, a code security firm that has tracked generative AI output since 2023, put the pass rate at just 55% in its latest audit, a number barely different from a year of frontier model releases. The gap between how fast software gets built and how safely it gets built showed up in breach reports and CVE databases through the first half of 2026.
Jose A. Rodriguez-Serrano, a professor at Esade Business School, argued this month in a Forbes op-ed that treating AI-generated software as nearly free ignores who absorbs the real cost. The data now shows where that cost actually lands, and it is rarely inside the prompt window.
Why the Demo Looks Like the Whole Job
Rodriguez-Serrano calls it the “demo trap”, the gap between how finished something looks and how much work actually remains. A handful of prompts can produce a landing page, a small game, or a working prototype that would have been impossible three years ago. The demo impresses because the scope is narrow and the requirements are simple.
Tools like Claude Code, OpenAI Codex, GitHub Copilot, Google Antigravity, Lovable, Replit, and Cursor have made that first mile dramatically shorter for people with little formal programming background. Enterprise software is a different animal. As a codebase grows and databases, APIs, and cloud services multiply, Rodriguez-Serrano notes that each additional prompt returns less. Past a certain size, the model starts losing track of context, and staying specific and coherent becomes a human developer’s job again.
The Security Pass Rate Has Not Moved
Veracode tested the newest flagship models from every major vendor this spring. Security pass rates stuck at 55%, with Java code performing worst despite decades of established secure coding practice.
Georgia Tech’s Vibe Security Radar project, run inside the university’s School of Cybersecurity and Privacy, tracks CVE entries tied specifically to AI-generated code. By March it had confirmed 74 AI-linked CVEs, a sixfold jump in monthly new entries since January, according to a Cloud Security Alliance research note. A separate 2026 study by AppSec Santa tested 534 code samples across six large language models and found that 25.1% contained confirmed flaws when checked against the OWASP Top 10 benchmark.
Estimates across these studies range from roughly one in five samples to three in five, mostly because they use different yardsticks: some validate strictly against OWASP’s list, others count broader code quality issues too. Every major 2026 audit still points the same direction.
Which AI Coding Models Fail Security Tests Most Often?
AppSec Santa’s six-model comparison found real spread between vendors: the best model passed roughly four out of five samples clean, while the worst three tied at a failure rate more than 50% higher. Injection flaws and server-side request forgery accounted for a third of every confirmed vulnerability across the whole study.
| AI Model | Confirmed Vulnerability Rate | Result |
|---|---|---|
| GPT-5.2 | 19.1% | Best of six models tested |
| DeepSeek V3 | 29.2% | Tied for worst |
| Claude Opus 4.6 | 29.2% | Tied for worst |
| Llama 4 Maverick | 29.2% | Tied for worst |
| All six models (average) | 25.1% | Overall confirmed rate against OWASP Top 10 |
The study cost the researchers under $10 to run through an API aggregator. Finding out which model wrote safer code, in other words, is now cheaper than most companies’ monthly cloud bill.
When a Vibe-Coded App Goes Live
Lovable is one of the very tools Rodriguez-Serrano names as lowering the barrier to building software. Security researchers who ran a scan of 1,645 Lovable apps found 303 vulnerable endpoints across 170 of them, roughly one in ten. Many had embedded a Supabase anonymous access key directly in client-side JavaScript, which let unauthenticated visitors read and write database tables holding personal data, financial records, developer API tokens, and administrative credentials.
That single finding puts a number on what Rodriguez-Serrano’s closing questions were really asking. The costs show up in the wider numbers too.
- $670,000 is the added cost IBM’s 2025 breach research attaches to incidents involving unsanctioned “shadow AI” tools, on top of ten extra days needed to contain them.
- 37% is the share of organizations with any policy at all governing employee AI use, according to that same IBM research.
- 80% of employees use AI tools their employer never approved, per Cloud Security Alliance findings.
- $492 million is what Gartner expects enterprises to spend on AI governance tooling in 2026 alone, a figure it projects will top $1 billion by 2030.
None of those figures existed as line items two years ago. They are now.
Andrew Ng’s Product Management Bottleneck
I call this the Product Management Bottleneck. Product management is the art and science of deciding what to build.
Andrew Ng, the DeepLearning.AI founder and Google Brain co-founder, wrote that once agentic coders remove the friction of writing software, deciding what to build becomes the new bottleneck. He draws the comparison to the typewriter, which made the physical act of writing far easier but produced a different problem: writer’s block, the struggle to decide what to write at all.
Rodriguez-Serrano frames the same shift as a question changing from “Can we build it” to “Why should we build it”, and argues that business domain knowledge and design judgment will outperform anyone who thinks a few prompts amount to disruption. Ng’s own teams at AI Fund and DeepLearning.AI now run small, high-autonomy pods rather than large teams with a traditional split between engineers and product staff, betting that a handful of people who understand the product deeply can move faster than a big org chart waiting on sign-offs.
The Skills AI Cannot Prompt Into Existence
Hillary Mason, a data scientist and startup founder, adds “the stubbornness of thinking about a problem” to the list of things AI cannot automate, and says that in the AI era, “taste matters.”
Rodriguez-Serrano points to a similar, overlapping set of abilities that hold up once a project moves past the happy path:
- Business domain knowledge, understanding what an organization actually needs rather than what is merely technically possible.
- Rigor for details, catching edge cases and inconsistencies an AI model glosses over once context gets large.
- Sensibility for design, shaping something people genuinely want to use rather than something that merely runs.
- Technical fluency held in reserve, since when a generated solution fails, users get pushed back into reading error messages, inspecting code, and running terminal commands themselves.
Those are the same abilities the vulnerability data keeps pointing back to. A model that loses context at scale still needs someone specific enough to notice.
Who Cleans Up the Sprawl?
More than 40% of enterprise AI systems still lack a clear regulatory classification, and over half of organizations have no systematic inventory of what they have deployed, according to Cloud Security Alliance research published in May. Some companies are hedging a different way. Firms already turning to global development teams as domestic tech costs climb are betting that experienced human oversight, wherever it sits, is still cheaper than cleaning up AI-generated sprawl after the fact.
Rodriguez-Serrano’s closing questions, about who owns inventory, who enforces standards, and how to stop hundreds of disconnected tools from piling up, are no longer hypothetical. Regulators have already set a date. The European Union’s AI Act requires companies to classify high-risk AI systems against its Annex III by August 2, 2026, with no good-faith exception for an employee’s weekend project nobody logged.
Frequently Asked Questions
Is AI-generated code less secure than code written by humans?
One 2026 comparison found AI-generated code was 1.88 times more likely to introduce a security vulnerability than code written by a human developer, with production incidents per pull request rising 23.5% between December 2025 and early 2026.
What is vibe coding?
Vibe coding describes building software by describing what you want in plain language and letting an AI agent write, run, and often deploy the code, frequently without the builder reading every line it produces.
Why are legal and marketing teams also becoming bottlenecks, not just product managers?
Once engineering compresses a build cycle from months to days, legal review and marketing messaging cannot keep pace either. A contract or campaign review that comfortably fit inside a three-month build now has to happen in the time it takes to ship a single day’s code.
How common is unapproved “shadow AI” use inside companies?
Roughly eight in ten employees use AI tools their employer has not formally approved, according to Cloud Security Alliance research, even though most of those same organizations still lack a policy to manage the practice.
Do AI coding tools mean developers no longer need to learn to program?
Andrew Ng has argued the shift creates more jobs rather than fewer, just different ones, pushing engineers away from writing every line themselves and toward system design and directing AI agents across a codebase.
