AI-Assisted Coding and Cybersecurity: What the 2026 Data Actually Shows

AI-assisted coding measurably raises enterprise security risk today. Just not in the way most headlines suggest. The strongest evidence does not point to a wave of cleanly attributed breaches. It points to three linked pathways: insecure code generation, hallucinated dependencies, and large-scale data leakage into GenAI workflows. Anyone waiting for clean incident statistics will react too late.

The numbers leaders need to know in 2026

Five figures from independent sources tell the same story:

• 45% of code samples across more than 100 LLMs failed security tests in 2025 (Veracode). In Java the failure rate hit 72%.

• 19.7% of packages recommended by LLMs do not exist. That is over 200,000 fabricated package names, an open vector for slopsquatting (USENIX Security 2025).

• 1,275,105 AI service secrets were detected on public GitHub in 2025, up 81% year over year (GitGuardian).

• Source code accounts for nearly half of all DLP violations against GenAI apps in enterprises (Netskope, more than 3,500 customers).

• 1 in 5 organizations report a serious incident tied to AI-generated code (Aikido, 450 respondents).

One framing point first. There is no unified market-wide metric for “AI-coding-related security incidents.” Verizon DBIR and ENISA do not yet classify AI-assisted coding as a separate incident category. The evidence on vulnerabilities, supply chain, and leakage is unusually strong anyway.

Pathway 1: Insecure code is being shipped, and people don’t notice

Four controlled studies over four years measure how often AI tools introduce vulnerabilities:

Syntax and usefulness improve faster than security semantics. Newer, larger models write more functional code, but not systematically safer code.

The overconfidence problem

A 2023 ACM CCS study (Perry et al.) with 47 participants and five security-relevant tasks found something more concerning than insecure suggestions. On a SQL task, participants with the AI assistant delivered safe solutions only 36% of the time. The control group without a tool reached 50%. 36% of the AI group were vulnerable to SQL injection, versus only 7% in the control group. Worse, the AI group was disproportionately likely to believe they had written secure code.

The damage does not come from insecure suggestions alone. It comes from overconfidence and review erosion.

The refinement-loop effect

A 2025 analysis of 400 code samples across 40 iteration rounds found that critical vulnerabilities increased by 37.6% after only five iterations. The more teams rely on agentic loops without hard intermediate reviews, the more plausible dynamic security degradation becomes, instead of a single-shot mistake.

Pathway 2: Slopsquatting and hallucinated dependencies

Probably the most underestimated supply chain threat right now. A USENIX Security study generated 576,000 code samples with 16 popular LLMs in Python and JavaScript:

• 19.7% of recommended packages were hallucinated

• Open-source models averaged 21.7% hallucination rate

• Commercial models averaged 5.2%, better but not zero

• JavaScript (21.3%) is hit harder than Python (15.8%)

• 205,474 unique non-existent package names

This is not an abstract quality problem. It is a direct attack vector. Adversaries observe LLM outputs, register hallucinated package names, and inject malicious code into supply chains as soon as a developer adopts the suggestion without checking. Slopsquatting is the AI-era version of classic typosquatting, with a far larger attack surface.

Pathway 3: Data leakage, the most visible problem today

Vulnerabilities sit inside code. Data leakage through GenAI tools shows up immediately in enterprise telemetry.

Netskope (link) across 3,500+ customers (2025)

• 90% of organizations use GenAI apps

• 98% use apps with embedded GenAI features

• 72% of GenAI usage is shadow IT

• Data volume sent to GenAI apps grew more than 30x year over year

• Source code accounts for nearly half of all DLP violations against GenAI apps

Harmonic Security (link): 22.46 million enterprise prompts

• 8.5% of all prompts contain sensitive information

• 45.4% of sensitive AI interactions go through personal email accounts

• 74.5% of exposure is code, legal documents, and financial data

• For ChatGPT, 53.5% of sensitive prompts go through the free tier

GitGuardian (link): secrets are leaking faster

• 28,649,024 new hardcoded secrets on public GitHub in 2025 (+34% YoY)

• 1,275,105 AI service secrets, up 81%

• Claude Code-assisted commits show a 3.2% secret-leak rate, against a 1.5% public GitHub baseline

AI-assisted workflows roughly double the probability that credentials get committed by accident.

Sector view: where the gaps are widest

In manufacturing, code exposure is almost as high as exposure of regulated data. In regulated industries like finance and healthcare, shadow and personal-account use stays high despite compliance pressure.

Backdoors and adversarial misuse

Unit 42 (Palo Alto Networks) (link) demonstrated in 2025 that indirect prompt injection through poisoned context can make a coding assistant silently insert malicious code into its output, including a function that downloaded and executed remote commands.

Teleport’s 2026 infrastructure survey (link) supplies the matching governance picture:

• 59% name “confidently wrong” configurations as a top risk

• 76% incident rate in organizations with over-privileged AI systems

• Only 17% incident rate where least-privileged access is enforced

• Only 3% of organizations use automated preventive controls for running AI systems

Germany’s BSI noted through mid-2024 that AI-based exploitation of software vulnerabilities at scale has not yet been observed in the wild. At the same time, IBM reports (link) that 16% of breaches in 2025 already involved AI assistance, primarily for phishing and deepfake impersonation. AI is amplifying attack automation and social engineering today. Fully automated AI exploit pipelines remain emergent rather than dominant.

The governance gap is bigger than the adoption gap

Probably the most important tension in the current data:

• By 2026, 42% of all commits are AI-assisted or AI-generated (Sonar)

• Only 48% of developers consistently review AI code before committing

• 96% of developers do not fully trust the functional correctness of AI code

• Only 18% of enterprises have AI-specific code guidelines or quality gates

• 76% of Stack Overflow respondents already use or plan to use AI tools

Adoption is outpacing control capacity. That gap, not any single breach, is the real story of 2026.

Cost and response time: the data gap

There is no clean AI-coding-specific cost data yet. The best proxies come from IBM’s 2025 breach dataset (link) of 600 organizations:

• Global average breach cost: $4.44M

• Additional cost when shadow AI usage is high: +$670,000

• Average breach lifecycle: 241 days to identification and containment

• Recovery typically takes more than 100 days post-breach

These figures are breach-wide, not AI-coding-isolated. They still set the cost frame CFOs and boards need to internalize.

What enterprises should actually do now

The evidence does not allow full reassurance. It does show clearly where the levers sit.

1. Add quality gates specifically for AI-generated code. SAST/DAST is not enough on its own. Dedicated checks for the CWE classes LLMs systematically get wrong (SQL injection, path traversal, crypto misuse) belong in CI.

2. Pin dependencies and use allowlists against slopsquatting. Never adopt fresh packages from LLM suggestions without verification. Lockfiles, signature checks, and internal mirror registries are no longer optional.

3. Scan for secrets before and during commits. Pre-commit hooks like gitleaks or trufflehog are the floor. For AI-assisted workflows, an additional check at PR time is worth the friction.

4. Apply DLP to GenAI endpoints. Browser- and endpoint-DLP that recognizes source code, regulated data, and credentials before they leave for external LLMs. With a clear policy on personal versus corporate accounts.

5. Enforce least privilege for AI agents. Coding assistants and agentic systems often get more rights than any junior engineer. Read-only defaults, tool whitelists, and sandboxed execution drove Teleport’s measured incident rate from 76% down to 17%.

6. Train reviewers against overconfidence. The CCS study is unambiguous: people working with an AI tool overestimate their own security. That expectation has to be addressed in the review culture itself.

7. 
   

Most of these controls converge at the same chokepoint: the pull request

That is where AI-generated diffs cross from sandbox into production, and where governance can either hold or fail silently. Some teams are starting to automate this layer directly: platforms like re-entry.ai score every PR for risk, enforce policy without manual triage, and keep an audit trail of every AI-written change so engineering keeps the final call.

Bottom line: the risk is visible, incident attribution is not

The strongest defensible case against unregulated AI coding today is not “every other company has had a breach because of it.” It is:

• A meaningful share of generated code remains insecure

• A measurable share of AI usage causes source code and secret exposure

• Governance, least privilege, and AI-specific quality gates remain minority practices

• Adoption velocity is outpacing review and control capacity

Three tensions deserve attention from decision-makers:

1. More model capability does not mean more security. Better functionality is papering over weaker security semantics.

2. High usage and high skepticism coexist. 76% of developers use AI tools, 96% do not fully trust correctness, but only 48% review consistently.

3. The largest real impact today is leakage and control, not breach categories. Anyone waiting for clean incident data will react too late.

The honest read for 2026: the risk is visible; precise incident attribution is not yet mature. That is exactly why governance, quality gates, and least privilege are not optional add-ons. They are the foundation without which AI coding productivity becomes a security liability.

Sources and methodology

Four evidence classes inform this article:

• Academic studies: Pearce et al. (2021/22), Perry et al. (CCS 2023), Majdinasab et al. (SANER 2024), Fu et al. (TOSEM 2025), Spracklen et al. (USENIX Security 2025)

• Vendor telemetry: Veracode (2025), Netskope (2025), Harmonic Security (2025/26), GitGuardian (2026)

• Incident and management surveys: IBM/Ponemon (2025, n=600), Aikido (2026, n=450), Kroll (2026, n=1,000), Teleport (2026), Sonar (2026, n=1,149)

• Regulatory framing: BSI situational reports, Verizon DBIR Finance Snapshot 2025

The most important caveat: studies today predominantly measure code quality, leakage, and governance, not forensically attributed incidents. Cross-source comparisons should be read with care. Multiple independent data types converge on the same risk pathways anyway, which is what makes the overall signal strong.