AI has improved substantially over the last few years, and AI coding agents are now widely used. They play a significant role in all of my recent projects, from the Weekplanner extension for Nextcloud to RecoveryCodes. As AI has improved, I've gradually come to trust the output more and spend less time reviewing it than I did before.
One area where this doesn’t yet work is security, because AI doesn't reliably account for security unless prompted. Code it writes regularly falls foul of basic security issues covered by the OWASP Top 10. Bappy et al. (2026) come to the same conclusion. They asked 15 software engineers with varying levels of experience to work on one of three tasks using AI: implement a feature, scaffold a new project from scratch or debug a concurrency vulnerability in Python. Each task involved security considerations; for example, the project-scaffolding task raised questions around secure defaults and secret management.
Before working on these tasks, all participants were interviewed individually. During the interviews, the more senior participants “tended to articulate more specific security concerns and name vulnerability classes more precisely, while junior engineers more often framed security as something to catch in review rather than specify upfront” (Bappy et al. 2026, 7). Overall, only two of the 15 participants independently noticed security vulnerabilities introduced by the AI. Both of these participants had prior experience with common security vulnerabilities (Bappy et al. 2026, 9). The other participants did not find any security vulnerabilities, even though they were present.
Combined with what I see in practice, this suggests that AI does not reliably produce secure code without explicit security guidance. Engineers therefore need enough security knowledge to recognise what the AI is failing to account for. In my experience, many engineers lack awareness of these basics and developing this knowledge often competes with delivery pressure. AI increases engineering throughput without necessarily increasing security competence. The result is that engineers can reproduce the same security blind spots at a much higher rate.
References
Bappy, Faisal Haque, Tahrim Hossain, Sidratul Muntaher Meheraj, Annoor Sharara Akhand, Tasfia Tabassum, Tarannum Shaila Zaman, Raiful Hasan, and Tariqul Islam. 2026. “From Preventive to Reactive: How AI Coding Assistants Transform Developers’ Security Awareness,” June. http://arxiv.org/abs/2605.23130.