Thank you for opening up the latest article in 'The Intelligent Commit' newsletter, my thoughts, research and analysis on Artificial Intelligence and how AI is reshaping the software development lifecycle. I hope you find it insightful, subscribe, and engage.
An article in The Register yesterday caught my attention because it cut across some of my Master's research into the psychology of trust and automation bias. Their article reports that 70% of developers know AI-generated code is more vulnerable, and yet 30% ship it anyway.
Devs know AI code is riddled with holes, but ship it anyway
My interest is what I found in other papers and research. The latest report suggests that developers know it to be insecure and ship regardless because deployment pressure wins. Other recent research found developers often believe their AI-assisted code is more secure than it actually is. Trust becomes important here, and how 'usability' becomes a proxy for 'trustworthiness'. Clean, well-structured output reads as correct output.
This article and prior studies are not contradictory, of course, even if at face value they appear to be. (I'm not suggesting they are, one does not negate the other).
What's not in doubt is the actual security posture of AI-generated code, which almost all industry and academic studies (including my own) indicate is less secure than human-developed code.
Are developers knowingly shipping insecure code, or are they genuinely overconfident?
So today I asked myself, are developers knowingly shipping insecure code, or are they genuinely overconfident? Probably both, depending on the team, the context, and how the question gets asked. The distinction matters enormously for what you do about it.
The Register article suggests a governance and culture problem. Overconfidence, however, is a calibration and tooling problem.
What my research did confirm is that tools to reduce this risk exist and they work. I found that agentic security review workflows cut vulnerability density by 77%.
The real questions come back to the underlying infrastructure and controls, and whether organisations are deploying them. As interested as I am into the psychology of trust and behaviours, it's that gap that remains the story for me.
Thank you for reading my latest article. Please share your experiences and engage with the discussion. I am not always right, but I try to be insightful and thought-provoking.
If anyone would like to discuss my research and findings, please reach out.
Sources
- The Register, "Devs know AI code is riddled with holes, but ship it anyway" — https://www.theregister.com/devops/2026/06/09/devs-know-ai-code-is-riddled-with-holes-but-ship-it-anyway/5252824