AI has come a long way over the last few years, and I think by now everyone uses AI in one form or another to either help with the business (administrative tasks) or coding (whether with a proper agent setup or individual chats). It plays an extensive role in all of my recent projects, from the Weekplanner extension for Nextcloud to RecoveryCodes. Depending on the task, I more or less look at the output during code review, but otherwise let the AI work freely as it sees fit.
One area where this doesn’t yet work is security, because AI does not think about security proactively. It seemingly doesn’t implement even basic concepts like the OWASP Top 10. Bappy et al. (2026) come to the same conclusion. They asked 15 software engineers with various levels of experience to work on one of three tasks using AI: Implement a feature, scaffold a new project from scratch or debug a concurrency vulnerability in Python. Each task had some security considerations; for example, when scaffolding a new project from scratch, one should think carefully about secure defaults and secret management.
Before working on these tasks, all participants were interviewed individually. During the interviews, the more senior participants “tended to articulate more specific security concerns and name vulnerability classes more precisely, while junior engineers more often framed security as something to catch in review rather than specify upfront.” (Bappy et al. 2026, 7) Interestingly enough, the same participants did not find a single vulnerability introduced by AI whilst working on their selected task. Only 2 participants out of 15 actually caught security issues unprompted. Both of these participants had prior experience with common security vulnerabilities. (Bappy et al. 2026, 9)
For me, this aligns with what I observe day to day: AI is not able to implement secure code proactively unless prompted repeatedly in that direction, meaning good knowledge about common security vulnerabilities is a baseline requirement to produce secure code using AI. In my experience, many engineers lack awareness about these basics and are not incentivised to learn about it, as it potentially slows down development of new features. That means a lot of engineers will continue to introduce security vulnerabilities into their codebase, but at a faster rate as they’re “AI-enabled”.
Bappy, Faisal Haque, Tahrim Hossain, Sidratul Muntaher Meheraj, et al. 2026. From Preventive to Reactive: How AI Coding Assistants Transform Developers’ Security Awareness. June. http://arxiv.org/abs/2605.23130.