The rapid expansion of software development in 2026 has produced an unprecedented volume of code, much of it written with AI assistance and deployed with minimal security scrutiny. The NVD registered more than 72,000 CVEs between January and September, compared with 48,244 for the full year of 2025.
AI coding tools enable developers to deliver functionality that previously took two weeks in a single afternoon. While the productivity gain is permanent, the side effect is that the quantity of code entering production now far exceeds the capacity of any team to review it line by line. Large portions of this code have never been examined by a human for security implications.
Models generate code that satisfies the requested functionality but contain no mechanism for anticipating how the same logic could be abused. The result is an increase in straightforward manual errors: endpoints lacking authorization checks, API keys left in repositories, and parameters that accept identifiers belonging to other customers.
These issues are not novel attack techniques; they are basic oversights in recently published code that attackers locate simply by looking first. Pentesting exists to surface such problems on the defender side, where remediation costs only a few hours and prevents any data loss or service interruption.
Criminal groups have integrated AI into their own operations, using it to scan applications, test hypotheses at scale, and identify weaknesses in a fraction of the time previously required. While attackers accelerate their discovery process, many organizations continue to rely on traditional review cadences that cannot keep pace.
The equation is straightforward: if an organization does not test its own code with an adversarial mindset, someone else will, and that party has no incentive to report findings responsibly.
