AI coding tools now generate code faster than engineering teams can review, test, or fully understand it. That has opened a widening gap between how fast software gets written and how carefully it gets reviewed.
Veracode’s latest GenAI code security update, published in October 2026, found that AI models still failed its security tests about 38% of the time. Meanwhile, AI already generates roughly half of all committed code, according to DX, so that failure rate reaches a growing share of production software.
An independent analysis pointed the same way. IOActive’s April 2026 whitepaper found that nearly a third of AI-generated code samples were fully exploitable.
That is how code review stops doing its job. JD Raimondi, Chief AI Architect at software consultancy company Making Sense, called it “approval theater”.
A developer reviews AI-generated code without understanding every decision behind it. The code runs, so it gets approved. Vulnerabilities, architectural flaws, and unintended privileges can slip through unnoticed. The company believes the code has been properly reviewed, when the review never went past the surface.
Developers know verification matters. Stack Overflow’s 2026 Developer Survey, released in October with more than 30,000 responses, found that 48% of developers trusted AI output only when they could easily verify it, and just 6.6% would trust it with important work decisions. When AI is producing half the code, verification is the step most likely to get skipped.
When AI coding outpaces engineering oversight
Raimondi will address the problem with Mariano Jurich, Forward Deployed Product Manager at Making Sense, in a free 30-minute webinar for CTOs and engineering leaders on Monday, November 16, at 2 PM EST/11 AM PST. Jurich has spent more than a decade building digital products and works with teams shipping AI-assisted code into real products.
Their starting premise is that not every risk in AI-coded software deserves the same level of concern. Some, like duplicate code or missing tests, are common but recoverable. Others are rare but severe, such as an agent with excessive permissions wiping production data.
The risks security tools may not see
The severe category has already happened. In July 2025, an AI agent on the coding platform Replit deleted a live production database belonging to SaaStr founder Jason Lemkin during a code freeze, wiping records on more than 1,200 executives and nearly 1,200 companies. The agent had been told not to make changes.
Replit CEO Amjad Masad publicly called the incident unacceptable, and the company later added safeguards separating development and production data.
Making Sense said these are the risks that scanners and basic checks can miss. An AI agent with far more access than it needs can run for weeks without incident, until a single wrong command deletes production data.
The code looks fine, and a security scan may never flag the problem, because the danger sits in what the agent is allowed to do rather than in any single line it wrote.
That shifts the question from the code to the process around it. The session will look at how teams can assess these risks within their own workflows, examining what agents can access, how changes get reviewed, and where monitoring falls short. The aim is practical safeguards that fit how a team already works, instead of another scanning tool layered on top.
If nobody reads the code, then who owns it?
AI speeds up how code gets written, but responsibility for that code stays with people. According to Making Sense, engineering teams are adopting AI coding tools faster than their review processes can adapt, and when nobody really reads the code, nobody really owns it.
That gap shows up in everyday questions. Who reviewed this change? Why was the agent allowed to touch this data? Can anyone on the team explain why the system works the way it does? When those answers are missing, a problem that starts in engineering quickly becomes a business problem.
Registration for the webinar is free and includes the AI-Coded Applications Risk Catalog, the research behind the session. Live attendees will also receive the recording and slides.
You can register to attend here.
Featured image: Getty Images via Unsplash+
Disclosure: This article mentions a client of an Espacio portfolio company.
10 c
11 c