×
Study finds 62% of AI-generated code contains security flaws
Written by
Published on
Join our daily newsletter for breaking news, product launches and deals, research breakdowns, and other industry-leading AI coverage
Join Now

As generative AI promises to revolutionize software development, technology leaders face a critical question: Will artificial intelligence eliminate the need for skilled engineers? History and current evidence suggest the opposite. While AI excels at generating routine code, the critical architectural work that distinguishes great software from merely functional systems remains uniquely human territory.

A recent study found that 62% of AI-generated code solutions contain design flaws or known security vulnerabilities, even when developers used the latest foundational AI models. This mirrors how AI might draft house blueprints that look perfect on paper, but without an architect’s knowledge of load-bearing walls, building codes, and soil conditions, most would have foundational flaws. We don’t eliminate building architects just because we can generate blueprints—we need their expertise more than ever to ensure what we build won’t collapse.

As Aravind Subramanian, a Deloitte partner and AI advisor, explains: “AI governance is more than just rules; it’s about creating a foundation of trust that supports innovation. By keeping humans in the loop, we inject empathy and judgment, crucial for navigating complex ethical landscapes. Governance isn’t a barrier; it’s a facilitator that empowers us to explore new ideas responsibly.”

This human-in-the-loop principle is why chief information officers must act now. The organizations that win won’t be those that generate the most code or adopt AI fastest, but those that maintain engineering discipline while leveraging AI’s capabilities. Your market differentiator lies not in the speed of code generation but in the quality of architectural decisions, the robustness of security implementations, and the elegance of solutions that only experienced engineers can provide.

The pattern recognition problem: Learning from history

Technology disruption follows predictable patterns, yet we consistently misread them. Consider these historical “extinction events” that never materialized.

When automated teller machines emerged in the 1970s, experts predicted the end of bank tellers. Reality proved different. According to research by James Bessen, a Boston University economist, the number of tellers in the United States doubled from approximately 300,000 in 1970 to 600,000 in 2010. While each branch needed fewer tellers—dropping from 20 to 13 between 1988 and 2004—banks opened 43% more branches, creating net job growth. Today’s tellers don’t count twenties; they solve complex financial problems and build customer relationships.

Fourth-generation languages (4GL)—high-level programming tools that promised to let business users write applications without traditional coding—were supposed to democratize programming in the 1990s. Instead, we now employ more software developers than at any point in history, tackling exponentially more complex challenges.

The cloud revolution was supposed to eliminate data center professionals. Instead, it created an entirely new category of cloud architects and engineers commanding six-figure salaries, while traditional IT roles evolved into hybrid cloud specialists.

Each disruption followed an identical trajectory: automation eliminated routine tasks, demand exploded for the underlying service, and workers moved up the value chain to more complex, creative work. Now, generative AI promises to automate software development itself. But this disruption brings a crucial difference that makes the engineering discipline more vital than ever: the 70% problem.

The 70% problem: AI’s glass ceiling

Peter Yang’s observation captures what every developer using AI tools has discovered: “Honest reflections from coding with AI so far: It can get you 70% of the way there, but that last 30% is frustrating. It keeps taking one step forward and two steps backward with new bugs, issues, etc.”

This isn’t a temporary limitation to be solved with the next generation of large language models. It’s the fundamental nature of pattern-based learning systems. Here’s the critical breakdown:

What AI handles well (The commoditized 70%)

The tasks AI excels at share common characteristics: they’re repetitive, pattern-based, and well-documented in training data. AI confidently generates boilerplate code—the standard, repetitive code structure that forms the foundation of applications. It implements standard CRUD operations (Create, Read, Update, Delete—the basic functions most applications need to manage data) and reproduces common design patterns. AI creates basic API endpoints (the connection points that allow different software applications to communicate), generates routine tests from existing patterns, produces documentation templates, ensures code formatting consistency, and handles simple refactoring tasks. These represent the commoditized layer of software development, where solutions are largely interchangeable and well-established.

What requires human expertise (The differentiating 30%)

The critical work that distinguishes great software from merely functional code requires human judgment and context. Edge case identification and handling demands an understanding of real-world scenarios that may never appear in training data. Security architecture and threat modeling require anticipating malicious actors and understanding your specific attack surface—the points where your system could be vulnerable to attack.

Performance optimization at scale involves trade-offs between competing constraints that vary by business context. Business logic validation and rules engines encode the unique value proposition of your organization. System integration and boundary definition require understanding both technical and organizational constraints. Architectural decisions involve long-term thinking about maintainability, scalability, and evolution. Technical debt management—handling the accumulated shortcuts and compromises that slow future development—requires balancing immediate needs with future costs. User experience polish and accessibility demand empathy and understanding of diverse human needs. Regulatory compliance implementation requires interpreting complex, often ambiguous requirements in your specific context.

Consider a real-world example: Ask AI to build a payment processing system and it will confidently generate transaction flows, database schemas, and basic error handling. But will it implement idempotency keys—unique identifiers that prevent duplicate charges during network failures? Will it handle the specific PCI compliance requirements (Payment Card Industry standards that protect credit card data) for your jurisdiction? Will it account for that edge case where a customer in Brazil pays with a local payment method that processes asynchronously?

These aren’t AI failures; they’re the difference between pattern matching and understanding. AI doesn’t grasp your business context, regulatory environment, or the ten-year history of architectural decisions that shaped your current systems. It can’t make the judgment calls that separate functional code from production-ready systems.

The evolution revolution: How engineering roles transform

Rather than eliminating engineering roles, AI is fundamentally transforming them—elevating practitioners from tactical implementers to strategic architects.

From security engineer to security architect

Yesterday’s security engineers spent their time on routine tasks: manually reviewing code for SQL injection vulnerabilities, creating password complexity rules, implementing basic firewall configurations, writing compliance documentation, and conducting periodic penetration testing. These activities, while necessary, were largely reactive and pattern-based.

Today’s security architects operate at a fundamentally different level. They design zero-trust architectures—security models that assume breach from the start and verify every access request—creating resilient systems rather than trying to build impenetrable walls. They develop sophisticated threat models for specific business domains and attack vectors, understanding that each organization faces unique risks. These architects are pioneering the development of AI agents that automatically remediate SAST findings—Static Application Security Testing results that identify vulnerabilities in code—turning security from a bottleneck into an accelerator.

They orchestrate AI-powered continuous vulnerability scanning while focusing their human expertise on systemic security design. Most importantly, they make risk-based security trade-off decisions that balance protection with usability, understanding that perfect security that prevents legitimate use is a business failure.

From performance tuner to performance architect

The evolution in performance engineering is equally dramatic. Traditional performance tuners focused on tactical optimizations: profiling code for bottlenecks, adding database indexes based on slow query logs, implementing caching layers, optimizing individual SQL queries, and reducing JavaScript bundle sizes. This work was important but largely reactive, addressing problems after they emerged.

Modern performance architects think strategically about performance from the ground up. They design global distribution strategies that maintain sub-100ms latency for users worldwide, understanding that user experience degrades exponentially with delay. They create intelligent caching strategies that predict access patterns, using machine learning to anticipate what data users will need before they request it.

These architects design event-driven systems that scale horizontally without human intervention, building in elasticity from the start rather than scrambling to scale during traffic spikes. They make sophisticated cost-performance optimization decisions, knowing when to invest in optimization versus when to simply add capacity. Most critically, they understand the business impact of performance decisions—how technical performance directly drives business outcomes.

From DevOps to reliability architect

The transformation from traditional operations to reliability architecture represents perhaps the most fundamental shift. Yesterday’s operations engineers were firefighters: responding to alerts, restarting failed services, writing shell scripts for common tasks, managing configuration files, creating runbooks for incident response, and monitoring system metrics. They were measured by how quickly they could respond to problems.

Today’s reliability architects are measured by how rarely human intervention is needed. They design self-healing systems that detect and recover from failures automatically, treating human involvement as a failure of automation. They create sophisticated error taxonomies that distinguish between user-impacting failures that demand immediate attention and silent errors that can be queued for batch resolution.

These architects build graceful degradation strategies that maintain core functionality even during partial outages, ensuring that users can complete critical tasks even when secondary features fail. They implement predictive failure analysis using machine learning to identify problems before they impact users.

Real-world evidence: The power of human-AI collaboration

A senior engineer recently tackled a complex caching issue that perfectly illustrates the human advantage. An open-source caching library was causing data inconsistencies, but only for users in specific geographic regions during peak load. The engineer used AI not as a replacement for thinking, but as an accelerator for analysis.

The AI helped analyze the library’s codebase, identifying potential race conditions—situations where multiple processes compete for the same resource simultaneously. But it was the engineer’s understanding of distributed systems, knowing that network latency variations could trigger specific timing windows, that led to the root cause. More importantly, the engineer made the strategic decision to develop a custom distributed caching library tailored to specific needs, using AI to accelerate the implementation while maintaining architectural control.

This exemplifies the optimal human-AI partnership: AI handles the routine analysis and code generation, while humans provide context, make strategic decisions, and ensure the solution aligns with business objectives.

The competitive advantage: Your 30%

Your architectural edge in the AI era isn’t whether you use AI—everyone will. It’s how effectively your engineers wield it while maintaining technical mastery. The organizations that win will be those that recognize the architectural layer as permanent, not a temporary limitation to be overcome. They’ll invest in engineers who excel at the differentiating third that matters, not just those who can craft clever prompts.

These organizations will build systems that leverage AI for acceleration while maintaining human oversight for critical decisions. They’ll create governance structures that ensure quality at AI-speed, preventing the accumulation of technical debt—the shortcuts and compromises that slow future development. Most importantly, they’ll develop talent that combines AI tools with deep expertise, creating engineers who are exponentially more capable than either human or AI alone.

Action plan: Building your AI-augmented engineering organization

Phase 1: Foundation (30 days)

The foundation phase is about understanding where you are and preparing for transformation. This isn’t about rushing to adopt AI tools; it’s about creating the conditions for successful augmentation.

Week 1: Assessment and discovery
Your first priority is understanding your current reality. This means more than just surveying who’s using ChatGPT or GitHub Copilot; it’s about understanding the deeper patterns of work in your organization.

  1. Survey current AI tool usage across all teams, including shadow IT adoption
  2. Map repetitive tasks that consume the most engineering time
  3. Catalog technical debt with an eye toward AI-assisted remediation
  4. Identify which decisions truly require human judgment versus tradition
  5. Document your organization’s unique constraints and compliance requirements

Week 2: Pilot team formation
Building the right pilot team is crucial. These aren’t just your early adopters or AI enthusiasts; they need to be your most thoughtful engineers who can see both opportunity and risk.

  1. Select 5-7 senior engineers representing different domains
  2. Include both AI optimists and skeptics for balanced perspective
  3. Choose 2-3 bounded projects: one greenfield, one refactoring, one integration
  4. Define success metrics beyond velocity: quality, maintainability, team satisfaction
  5. Establish weekly learning sessions to share discoveries

Week 3: Governance framework
Without governance, AI adoption becomes chaos. But governance doesn’t mean bureaucracy; it means creating guardrails that enable speed while maintaining safety.

  1. Create AI code review standards specific to your technology stack
  2. Define mandatory security scanning for AI-generated code
  3. Establish quality gates that catch common AI antipatterns
  4. Document clear policies on where AI assistance is mandatory vs. prohibited
  5. Build monitoring systems to track AI tool usage and impact

Week 4: Communication and alignment
The success of your AI transformation depends more on psychology than technology. Address fears directly, build excitement authentically, and create psychological safety for experimentation.

  1. Craft an augmentation narrative emphasizing empowerment over replacement
  2. Host town halls to address job security concerns transparently
  3. Share both successes and failures to build trust
  4. Secure executive sponsorship with realistic ROI projections
  5. Launch with clear metrics and regular progress updates

Phase 2: Excellence programs (90 days)

The excellence phase transforms pilot success into organizational capability. This is where you move from individual experiments to systematic improvement. The goal isn’t to train everyone to use AI tools; it’s to develop engineers who can wield AI effectively while maintaining engineering excellence.

Architecture excellence track
Architecture is where AI’s limitations become most apparent and human judgment most valuable. Your architects need to become orchestrators of human and machine intelligence.

  1. Teaching system design with AI as a brainstorming partner
  2. Creating architectural decision records documenting AI vs. human decisions
  3. Building pattern libraries of AI antipatterns in your domain
  4. Establishing mentorship programs pairing architects with AI-augmented engineers
  5. Developing architecture review processes that account for AI-generated components

Security excellence track
Security cannot be an afterthought in the age of AI code generation. Your security engineers need to evolve from gatekeepers to enablers, building security into the development process.

  1. Developing AI agents that automatically remediate SAST/DAST findings
  2. Creating threat models specific to AI-generated code risks
  3. Building automated compliance validation for regulated industries
  4. Establishing security champions embedded in development teams
  5. Implementing continuous security validation at AI-generation speed

Quality excellence track
Quality assurance must evolve to handle the volume and variety of AI-generated code. This isn’t about testing more; it’s about testing smarter.

  1. Implementing property-based testing to catch edge cases AI misses
  2. Establishing chaos engineering practices for AI-generated systems
  3. Creating performance benchmarks that run continuously
  4. Building technical debt tracking that identifies AI-generated debt
  5. Developing quality metrics that balance speed with sustainability

Phase 3: Scale and optimize (Ongoing)

Scaling isn’t about doing more of the same; it’s about continuous evolution and adaptation. The metrics you track, the talent you develop, and the culture you build will determine whether AI becomes your competitive advantage or technical debt generator.

Metrics that matter
Move beyond vanity metrics to measurements that drive real improvement:

  1. AI amplification ratio: Not just productivity but value creation per engineer
  2. Technical debt velocity: Are you paying down or accumulating debt?
  3. Innovation index: Time spent on creative vs. routine work
  4. Quality indicators: Defect rates, performance degradation, security incidents
  5. Team satisfaction: Are engineers energized or exhausted by AI tools?

Talent development strategy
The engineers who thrive in the AI era will be those who combine deep technical expertise with AI fluency:

  1. Partner with universities to influence curriculum toward fundamental skills
  2. Create apprenticeships focused on the critical 30% of engineering work
  3. Establish rotation programs across architecture, security, and performance roles
  4. Build continuous learning platforms for rapidly evolving AI capabilities
  5. Develop career paths that reward AI-augmented expertise

Cultural transformation
Culture eats strategy for breakfast, and this is especially true for AI adoption:

  1. Celebrate learning from AI-related failures as much as successes
  2. Reward engineers who identify AI limitations, not just those who embrace it
  3. Create psychological safety for questioning AI-generated solutions
  4. Promote collaboration between AI optimists and skeptics
  5. Build a culture of continuous experimentation and adaptation

Operationalizing excellence: The MaintainabilityAI SDLC Framework

To operationalize these excellence programs, organizations need a concrete framework that embeds human judgment at critical decision points while leveraging AI for acceleration. The MaintainabilityAI Software Development Life Cycle Framework provides this structure by ensuring that the architectural layer remains under human control while AI accelerates routine tasks.

This framework ensures that humans own the architecture and governance gates—where systems succeed or fail—while AI handles implementation and verification where speed matters most. Like building architects who ensure structures are safe, sound, and secure at scale, your engineering architects maintain oversight at critical decision points. Each gate represents a deliberate moment where human expertise validates AI output against business objectives, security requirements, and architectural principles.

The framework’s power lies in its clarity: this isn’t about slowing down development; it’s about building fast without sacrificing the structural integrity that keeps systems standing under pressure.

The hard truth: Speed without quality is technical debt at scale

AI can generate code at unprecedented speed. Without proper engineering discipline, this means accumulating technical debt at unprecedented speed. A poorly architected system built in days instead of months is still a poorly architected system—it just fails faster.

Your best engineers understand this. They know that AI-generated code is a hypothesis requiring validation. They recognize that every automated process introduces risk requiring assessment. They see AI not as a replacement but as a powerful tool that makes their expertise more valuable, not less.

The goal isn’t to write code quickly but to create systems that can evolve sustainably. In a world where technical debt can accumulate at machine speed, the ability to maintain architectural integrity becomes even more critical.

Leading the transformation: A CIO’s imperative

As technology leaders, we must become orchestrators of human and artificial intelligence, creating environments where both thrive. This starts with reframing the narrative: stop discussing AI as a replacement for developers and position it as an amplifier for engineering talent. Every communication should emphasize enhancement, not elimination.

Investment in technical mastery becomes paramount. Create clear paths for engineers to deepen expertise in architecture, security, performance, and reliability. These aren’t just senior engineers with new titles; they’re professionals who understand systems at a fundamental level and can make the judgment calls that separate good software from great software.

Building learning organizations is essential for long-term success. The specific AI tools you adopt today will be obsolete in three years, but organizations that master human-AI collaboration will thrive regardless of which tools emerge. Focus on principles and practices that transcend specific technologies.

Celebrate success stories that reinforce the augmentation narrative. Highlight the architect who used AI to refactor a legacy system in weeks instead of months while maintaining architectural integrity. Share how security engineers leverage AI for vulnerability scanning while designing secure architectures. Make heroes of those who master the 30%, showing that human expertise combined with AI tools creates capabilities neither could achieve alone.

The future belongs to engineering excellence

History is clear: technological disruption doesn’t eliminate knowledge workers; it elevates them. Just as ATMs freed bank tellers to become financial advisors, AI will free engineers to become architects, strategists, and innovators. The question isn’t whether your engineers will survive the AI revolution. It’s whether your organization will thrive by giving them the tools, training, and trust to lead it.

In a world where anyone can generate code, the ability to generate the right code, for the right reasons, with the right quality, becomes the ultimate differentiator. That ability remains uniquely human. It’s found in the engineer who knows why that database query is deliberately inefficient to avoid locking during peak hours. It’s in the architect who remembers the three-year-old decision that makes microservices wrong for your context. It’s in the security expert who understands not just how to prevent breaches, but how to design systems that fail safely when breached.

This is the engineering imperative: not to resist AI, not to surrender to it, but to forge a partnership that amplifies the best of both. The organizations that win won’t be those that generate the most code or move the fastest. They’ll be those who maintain technical craftsmanship while leveraging AI’s capabilities, who treat the architectural edge not as a problem to solve but as their strategic moat.

The future belongs to organizations that recognize this truth and act on it today. The ability to evolve software systems effectively separates successful organizations from those that collapse under their own technical weight. In the AI era, this ability becomes even more critical.

To lead this transformation, CIOs must embrace the architectural layer as permanent reality, reframe the narrative from replacement to amplification, build governance as an innovation accelerator, invest in excellence programs for architecture and security, measure what matters beyond velocity, develop talent for the AI era, and celebrate the human advantage.

The window for action is now. Organizations that move decisively to build AI-augmented engineering sophistication will dominate their markets. Those who wait for AI to “get better” or rush to automate without governance will accumulate technical debt that becomes insurmountable. The choice is yours: lead the transformation or become its casualty.

The engineering imperative: Why AI won’t replace your best developers

Recent News

Bevel raises $10M for AI that unifies health tracking without expensive hardware

Users open the app eight times daily, transforming scattered health data into personalized insights.

Canva launches AI-powered Creative Operating System for complete marketing workflow

The company's proprietary Design Model learns from campaign performance to optimize future creative workflows.

Google strikes 25-year deal to restart nuclear plant for AI data centers

AI's massive energy appetite is making nuclear power economically viable again.