Enterprises are shipping so much AI-generated code they can't control or secure it

AI code generation is running out of control, with eight-in-ten organizations adopting AI tools faster than they can develop policies to govern them, new research has warned.

According to GitLab's AI Accountability Report, 92% are facing governance challenges with AI-generated code as rapid adoption continues.

More than nine-in-ten have two or more AI coding tools in active use, the study found, while 54% have three or more. Meanwhile, 78% report that developers are writing and committing code faster since adopting AI tools.

Teams are generally happy with the results, with six-in-ten saying that the ROI of AI coding is better than they'd expected. More than three quarters (78%) also report faster code output and 73% said overall code quality has improved.

Latest Videos From

Watch full video here:

However, while 79% agree that individual developer productivity has improved with AI, the overall software delivery process has not accelerated at the same pace.

Indeed, 82% say that AI-generated code risks creating a new form of technical debt that organizations aren't prepared to manage.

"AI coding tools have delivered on their promise of speed," said Manav Khurana, chief product and marketing officer at GitLab.

"But the events of the past few months, including supply chain attacks, reliability issues, and regulators tightening expectations around AI traceability and provenance are making clear that speed without control is a liability, not an advantage."

AI coding is creating new bottlenecks

Notably, 85% agree that AI has shifted the bottleneck from writing code to reviewing and validating it, and 84% that the biggest challenge with AI-generated code is governing what happens to it after it's created.

Nearly-three quarters are concerned about the maintainability of AI-generated code in their organization's codebase.

GitLab also raised concerns about a prevailing trend of overconfidence when it comes to AI coding. The majority (87%) said they’re confident that teams could determine within 24 hours whether AI-generated code contributed to a production incident, for example.

Yet more than one-third (34%) of organisations fail to spot potential issues before an incident took place.

This appears to be down to difficulty distinguishing AI-generated from human-written code (43%), fragmented toolchains (40%), and systems that don't track code origin (39%).

Only 28% say their software development lifecycle (SDLC) tools are fully integrated with shared data and workflows.

New governance practices are needed

According to GitLab, what’s missing is clarity around governance. The majority (83%) of organizations identify AI-generated code accumulation as a risk to manage now, with 44% calling it a top technology risk.

On the upside, 91% of survey respondents said they are likely to invest in AI code governance tools in the next 12 months, and 98% have already allocated or expect to allocate budget toward these efforts.

Crucially, 85% agree the next phase of AI in software will focus less on generating code and more on governing it.

"The teams thinking ahead are already asking the harder question: can we actually control all the code we’re generating?" said Khurana.

"The organizations that will ship trusted software faster are the ones building the foundations of accountability with context, traceability, and governance baked into the platform, not just bolted on after the fact."

AI governance has been a persistent challenge for developers, with research from Aikido last year concluding that AI-generated code is now the cause of one-in-five breaches.

The study noted that 69% of security leaders, engineers, and developers had identified serious vulnerabilities in AI-generated code.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.