Driving 200 miles per hour doesn’t take any particular skill. But the world’s top racecar drivers earn tens of millions of dollars per year because they can do it safely.
It’s an analogy that applies to the current state of software development. Teams are using generative and agentic AI to dramatically accelerate time-to-market, using “vibe coding” processes in which AI tools generate the bulk of the code. To take one prominent example, the Wall Street Journal reports that Morgan Stanley used an in-house AI model to review 9 million lines of code during the first five months of 2025 — saving developers a total of 280,000 hours.
The real trick, though, is to not merely code more quickly, but to do so without opening up new vulnerabilities to cyberattackers, says Eran Kinsbruner, vice president of portfolio marketing at Checkmarx.
“AI-generated code often inherits insecure patterns from open-source repositories, which form the backbone of most LLM training data,” says Kinsbruner. “Because these models don’t have access to proprietary, vetted code, they draw from publicly available sources, including libraries known to contain vulnerabilities. That means insecure code can be introduced faster and more broadly unless properly scanned and secured.”
For instance, GitHub Copilot is powered by OpenAI Codex. According to OpenAI, Codex is trained on “billions of lines of source code from publicly available sources,” including code found in public GitHub repositories.
Checkmarx, Kinsbruner notes, has identified and cataloged more than 400,000 malicious code packages across open source libraries. What’s more, Kinsbruner says that agentic AI exacerbates these risks. As development teams move toward agentic AI solutions that tackle larger and larger tasks autonomously, they must protect their projects against several dangerous phenomena. These include:
- Package hallucination, when AI selects entire code packages that either don’t exist or are malicious.
- Context misclassification, when AI tools provide code for a different context than development teams intended, potentially causing security risks.
- Data poisoning, when attackers intentionally inject malicious code examples into open source repositories, knowing they will eventually be used by AI agents.
Understandably, Kinsbruner says, these risks have caused some organizations — especially those in highly regulated industries like healthcare and finance — to approach AI-assisted development with caution, potentially delaying their time-to-market. “They have been very hesitant about adopting AI-generated code, because they are afraid of the cybersecurity outcomes,” he says.
With the right tools, development teams can embrace the faster processes enabled by AI tools, without compromising security. Kinsbruner notes that Checkmarx One Assist actually provides security-related feedback directly inside AI-powered integrated development environments, scanning code before it is ever exported from AI development tools like Cursor. This means that Checkmarx One Assist can identify vulnerabilities in real time as developers use AI to write code, rather than waiting for traditional security reviews later in the development cycle.
“We scan almost 600 billion lines of code every month,” Kinsbruner says. “We are catching hallucinations and new vulnerabilities, and we’re doing it at the pre-commit stage. That reduces noise in the software development cycle, and it helps organizations protect their applications while producing new code at the speed of AI.”
Get secure code at AI speed. Visit Checkmarx One Assist for more information.