Deep Dive - AI-Generated Code: The Security Risk Hidden in Plain Sight

AI tools now write nearly half the world's code — and they're introducing vulnerabilities at roughly twice the rate developers used to. This episode breaks down what's actually going wrong, explains a genuinely new kind of attack called prompt injection, and tells you what to watch for and ask about as a business owner. AI-generated (NotebookLM) audio overview. Source: HexLocal in-house research — AI Made Code More Dangerous: The Security Crisis Nobody Is Talking About (Dr. Priya Nair). Primary external sources include Black Duck's 2026 OSSRA report, Veracode's 2025 findings, and OWASP's AI security guidance. - AI now generates or assists roughly 42% of all code — and that speed comes with a documented doubling of vulnerabilities per codebase - "Vibe coding" — prompting an AI for code and shipping it without review — is a real and named industry problem, not just a cautionary metaphor - Prompt injection is a new attack class that hides malicious instructions inside ordinary content an AI reads, bypassing traditional code-level defenses - CVE-2026-25592, rated maximum severity 10.0, was the moment prompt injection became an officially catalogued, real-world threat in Microsoft's Semantic Kernel - AI agent-specific vulnerabilities spiked an estimated 255% year-over-year — a separate and sharper trend from the general code vulnerability rise - OWASP now publishes AI-specific security guidance, giving business owners a credible checklist to use when asking vendors the right questions