AI-Assisted Coding Shipped Faster, and the Security-Review Debt Is Coming Due

AI coding assistants have measurably increased how much code individual engineers produce, and organizations that adopted them broadly report shorter cycle times from task assignment to shipped pull request. That productivity gain is real and has been the dominant story in coverage of AI coding tools. Less covered is a second-order effect security teams have started raising: the volume of code entering review pipelines has grown faster than security and code-review capacity has, because review was never the bottleneck AI coding tools were built to remove, and a process built around a slower human authoring rate does not automatically scale when the authoring rate triples. The vulnerability classes showing up are not exotic. AI-generated code reproduces the same categories of mistakes — injection flaws, insecure dependency choices, missing input validation, authentication logic that looks superficially correct but has a subtle bypass — that human-written code has always produced, at a rate that tracks the training data's own mix of secure and insecure examples rather than at some uniformly worse or better rate than human output. The problem isn't that AI writes categorically worse code; it's that more code, reviewed with the same review capacity, means a higher absolute number of flaws reach production regardless of the per-line defect rate staying roughly constant. Static analysis and AI-assisted code review tools have become the default proposed fix, on the logic that if AI can generate code faster than humans can review it, AI-assisted review needs to scale to match. This has produced its own second-order concern among security teams: a review pipeline that increasingly consists of one AI system checking another AI system's output, with a human in a supervisory rather than line-by-line role, shifts the trust question from "is this code correct" to "is this review process actually catching what it claims to catch," a harder thing to verify and audit than a human reviewer's sign-off. Organizations further along in adoption report the most effective mitigation has been process rather than tooling: treating AI-authored code as requiring the same or greater scrutiny as a junior engineer's first contributions, rather than assuming competent-sounding output correlates with correct output, and building review capacity growth into the AI-coding-tool rollout plan from the start rather than treating it as a cost to absorb after adoption already happened. That is a straightforward, almost boring recommendation, which is itself notable — the fix for a scaling problem in code review has turned out to be scaling code review, not a new AI capability solving the gap AI coding tools created.