Securing AI-Generated Code in Production

This white paper draws on the seventh working session of the AI Security Council, where security leaders from Upwork, Intrado, Steve Madden, Good Day Farm, PerfectSync Cyber, AcceleTrex, Bayvision, the University of Memphis, Lidl GB, and CISA worked through what changes in the software development life cycle when AI writes most of the code and security still has to inspect it.

What You'll Learn

• Why the acceptance rate is a review signal, not a quality signal, and the escaped-defect metric one member already audits under ISO 9001 and will use to compare 2026 against prior years
• How to measure the share of AI-written code when agent-authored pull requests are visible and developer-accepted suggestions mostly aren't
• Who owns bad code once it escapes, as argued by the members who put accountability on the merging team, the product owner, and security's own tooling
• Why scrutiny should be tiered by what a change touches rather than by who or what wrote it
• What it means to put your standards in the harness, so the coding agent sees your threat model, approved SDKs, and secrets manager on every task
• The rubber stamp gap, named in session chat, and why a qualified human reviewer is the operative requirement
• Two incidents told by the members who lived them, where a coding agent hard-coded environment values against its instructions and an engineer built a working application on a personal laptop with company IP
• How to rehearse the sweep, so you can find a recurring AI-generated flaw everywhere it landed, through a tabletop exercise and the incident response playbook
• A five-level self-assessment model built from the controls members said they would require

Download the white paper to see how practitioners are measuring, reviewing, and governing AI-generated code before it reaches production, in their own words and attributed by name.