The AI coding assistant the developer has been using has quietly expanded the attack surface the security team has been defending. The code the AI wrote, the dependency the AI added, the configuration the AI suggested, the surface the security team did not know about until the security team ran the inventory. The honest framing matters here, because the AI coding assistant the developer adopted to move faster sits as the AI coding assistant the security team now has to defend the surface the assistant created.
What follows runs as the working version of the field guide. The shorter version is what the security team and the engineering team actually have time to read.
Where the AI expanded the surface
Three places, in roughly that order of how much each one matters. The first runs as the new code path, where the path the AI generated for the feature, the path the developer did not read carefully, the path that introduced the SQL injection, the missing auth check, the hardcoded secret, the path the security scanner will eventually find. The second runs as the new dependency, where the dependency the AI added to the package.json, the dependency the developer did not know the AI added, the dependency that ships the vulnerable transitive library, the dependency the security SBOM will eventually list. The third runs as the new configuration, where the configuration the AI generated for the deployment, the configuration that opened the CORS, the disabled authentication, the broad IAM role, the configuration the security reviewer will eventually catch.
What the typical finding looks like
Three findings, in roughly that order of how often each one shows up. The first runs as the auth bypass, where the bypass the AI introduced because the AI did not see the requirement the developer has been enforcing, the bypass that lets the user access the resource without the authentication, the bypass the security test will eventually catch. The second runs as the secret in the code, where the secret the AI used for the test, the secret the developer committed because the developer did not read the diff, the secret the secret scanner will eventually catch. The third runs as the data exposure, where the exposure the AI introduced through the missing output filter, the missing field mask, the missing authorisation check, the exposure the security test will eventually catch.
What to do about it
Three moves if you are the security or engineering team that wants to keep using the AI coding assistant without expanding the attack surface the security team has to defend. Run the security scan on every AI commit, because the scan the static analysis (the Snyk, the Semgrep, the CodeQL) runs on the diff, the scan that catches the AI introduced vulnerability the developer review missed, the scan the CI pipeline can enforce automatically. Add the dependency check on every AI change, because the check the SBOM tool (the Syft, the Trivy, the OWASP Dependency Check) runs on the diff, the check that catches the AI introduced dependency the developer did not know about, the check the platform team can add to the pipeline in a sprint. Review the AI configuration change, because the change the AI generated for the deployment, the change the security team should review before the change ships, the review the security team can do on the IaC diff the same way the security team has been reviewing the human generated diff, the review the AI tooling should support by surfacing the AI generated change differently. The team that scans, checks dependencies, and reviews the configuration serves as the team that has used the AI without expanding the surface the security team has to defend.
The bottom line
The AI coding assistant and the attack surface in 2026 sit as the trade off the security team has been navigating. The new code path, the new dependency, the new configuration, those three are where the surface expanded. The auth bypass, the secret in the code, the data exposure, those three are the typical findings. The security scan, the dependency check, the configuration review, those three are the moves. The team that does the three keeps the AI productivity. The team that skips the three serves as the team that finds the AI introduced vulnerability in the postmortem.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
