The 45% Problem: Catching Vulnerabilities in AI-Written Code

The uncomfortable finding from Veracode’s 2026 GenAI code-security work is that the vulnerability rate for AI-generated code has barely moved in two years of rapidly improving models — it sits around 45%.¹ And the assistants writing a growing share of production code are the same ones now sitting in your IDE.

What makes that 45% dangerous isn’t that the code looks broken. It’s that it looks perfect. It reads clean, it passes review, and it ships the flaw anyway.

I build agents that modernize code older than I am — decades-old mainframe systems where a wrong answer reaches a customer’s core systems. So I’ve had to get concrete about trust. Here’s the setup, minus the theory.

The ship-it hook

Never eyeball an AI diff again. Wire a pre-merge hook (a Kiro hook, a pre-commit subagent — the mechanism matters less than the discipline) that runs your merge checklist automatically on every change:

• Did it touch code you didn’t ask it to touch?
• Does a test the model didn’t write still pass?
• Did it invent an API, a config value, or a dependency?

Set it once, and bad code gets caught before you even open the diff.

The 10-second triage

Three questions sort any AI change: verifiable? reversible? repeatable? Most changes clear on the first question — you can prove correctness directly — so you stop agonizing and start merging. The ones that fail are exactly the ones that deserve a human.

The reviewer that remembers

The highest-leverage piece is a second agent that reviews the first — but grounded in a knowledge graph of your codebase, your standards, and every past incident. A stock reviewer catches generic issues; a grounded one catches the context-specific bug that only makes sense against your history. That’s the difference between a linter and a colleague.

The goal isn’t to trust AI code blindly. It’s to build the checkpoints that let you delegate the work without delegating the accountability.

Adapted from my DevCon 2026 talk. Questions or corrections welcome — reach out.