The recent introduction of Mythos showed us something important: frontier AI is becoming useful not just for generating code, but for finding serious weaknesses in it. On its face, that looks like progress for software security. But better bug-hunting is only half of the story.
The same technological leap that makes models better at spotting flaws is also accelerating software production faster than most organizations can keep under control. The result is a strange paradox: AI is making individual pieces of code more secure, but it’s also leaving the broader software more exposed.
In other words, we are trading depth for breadth. AI may help a developer polish a single function to near perfection, but that same developer is now shipping far more services than before. We are winning the battle at the line-of-code level, while losing ground at the infrastructure level, as the number of systems, services, and endpoints grows faster than they can be secured.
Therein lies the rub: as the cost of building software falls, its volume rises. Security will hinge on whether organizations can keep track of what AI helps them create. At a time when software is built at unprecedented speed, the advantage will go to the teams that retain clear visibility into their exposure and move before attackers do.
AI is already improving routine security work
According to Google Cloud’s 2025 DORA research, which surveyed nearly 5,000 technology professionals, AI adoption among software professionals has surged to nearly 90%, with respondents now using it routinely for writing, summarizing, and explaining code.
In many cases, it is already helping improve code quality. AI can catch obvious mistakes earlier, recommend safer patterns, and reduce the number of basic flaws that reach production. It can also raise the floor for less experienced developers, making secure practices easier to apply consistently.
But this is exactly what makes the broader risk easy to miss. The upside is immediate and visible, but the downside is slower, quieter, and cumulative. Risks build over time as AI increases the volume of code faster than most organizations can properly track, review, or maintain. Pointing to the real issue: software security is not the same thing as code security.
Software security ≠ code security
AI-generated code should never be treated as inherently safe. Multiple studies have shown that AI-assisted development can still introduce common vulnerabilities, including those in the OWASP Top 10. Developers who use AI assistants are also more likely to believe their code is secure; so the idea that AI simply writes “better” code is shaky to begin with.
The larger issue goes beyond flawed snippets. AI-generated code often appears cleaner or more maintainable on the surface than human-written code, making outputs look more polished and production-ready than they actually are.
That matters because software security is not just about whether one block of code is well written. It is about whether organizations understand what they have deployed, what is internet-facing, who is responsible for it, and whether it is still being maintained. As AI helps teams ship more code, more tools, and more services, the attack surface grows alongside it, often in fragmented ways that are difficult to track.
In other words, the more software organizations can create, the more opportunities they have to lose sight of it.
This is the core of the problem. Risk accumulates in overlooked places: forgotten assets, stale services, exposed test environments, internal tools that quietly become production infrastructure, and systems no one clearly owns. Increasingly, it also includes AI-generated services that are spun up in minutes and abandoned just as quickly, leaving behind orphaned code and exposed endpoints. These are the conditions attackers look for, not because they are sophisticated, but because they are neglected.
That is why visibility becomes a first-order security requirement. Organizations cannot secure what they do not know exists, and AI coding increases the volume of software far beyond the pace of most inventories, reviews, and governance processes.
What companies should do now
The first step is to recognize what AI-generated code actually is. In fast-moving environments, it often gets treated as closer to production-ready than it should be. In reality, it is accelerated draft material: useful, often impressive, but still in need of scrutiny.
From there, the focus has to widen. Secure development practices still matter, but they are no longer enough on their own. Companies need visibility into what exists, what is exposed, what has changed, and what no one clearly owns. They need to think beyond the codebase and toward the broader attack surface, especially internet-facing assets, legacy infrastructure, and systems that have quietly drifted into production.
They also need to measure the right things. Code review completion is not the same as security. In fast-moving environments shaped by AI-assisted development, organizations should assume their software inventories are incomplete and build around that reality.
That means replacing one-time assurance with continuous validation. In the AI era, the challenge is no longer just “Is this code secure?” but “Do we actually know everything we’ve built and exposed?” Organizations need tools and processes that ensure their entire attack surface is accounted for on a continuous basis. They need to see it clearly, understand its risk, and verify that it remains safe as the environment changes around it.
The organizations that win in the AI era will be those that preserve visibility and control as software volume surges. AI may help write cleaner code, but unless companies can keep track of what they are building, exposing, and maintaining, their software estate will remain less secure.
_____
About Rickard Carlsson
Rickard Carlsson is the CEO of Detectify, an application security testing platform that scales real-world hacker research with AI to help AppSec teams find and fix their most exploitable risks before attackers do.
Join our LinkedIn group Information Security Community!
