Loading issue research
Federal high-risk code should get continuous AI-assisted review, active monitoring, and fast, verified autonomous patching for confirmed vulnerabilities.
Verification Status
AI-researched, unverifiedLast Reviewed
Jul 6, 2026
Cited Sources
15
What is failing, what we would change, and the conclusion we are willing to defend.
AI coding assistants are now central to how software gets built, and the shift happened fast. At one major technology company, the share of new code that's AI-generated climbed from roughly a quarter in late 2024 to about three-quarters by mid-2026. A large, methodologically disclosed 2026 developer survey found 90% of professional developers already use at least one AI coding tool at work. That adoption reflects a technology earning its place: it measurably speeds up delivery, and the large majority of that code ships without incident.
One finding is worth taking seriously alongside that success. Developers using AI coding assistants write less secure code on average, and are more likely to believe their code is secure than developers without one. This is distinct from AI-11's broader AI-and-labor question, which covers the employment effects of AI on software engineering as an occupation; this issue is about supply-chain security specifically, and what standard code has to clear before it ships into a system where a lapse actually costs something.
Human sign-off doesn't scale to the volume of AI-generated code already shipping, and a rubber-stamp review is worse than no review: it creates the appearance of scrutiny without the substance. The mechanism that actually works is already proven at real scale. DARPA's 2025 AI Cyber Challenge ran seven autonomous systems against five real open-source codebases, including the Linux kernel, for 143 hours, with no human sign-off on any individual fix: they found 86% of the seeded test vulnerabilities, patched 68% of what they found, and along the way discovered and patched real, previously-unknown vulnerabilities in that same production code. Google's "Big Sleep" AI agent caught a critical SQLite vulnerability that threat actors already knew about, months before it would otherwise have been found. GitHub's Copilot Autofix cuts the median time to fix a known vulnerability class from about an hour and a half to under thirty minutes. None of this replaces professional accountability: a developer who ships code into a security-sensitive system is held to the same standard of care regardless of whether a human or a model wrote the first draft. It replaces the idea that a human has to be the one checking every line for that accountability to mean something.
Require continuous automated security review for AI-assisted code in security-sensitive and safety-sensitive federal systems: static and dynamic analysis plus frontier-model-assisted review run against every change through a continuous gate.
Require frontier-model-assisted review specifically for high-risk, high-impact code across federal agencies, scaled by risk tier the same way this platform already scales frontier-model oversight generally (see AI-02), not a blanket mandate applied to every commit everywhere.
Fund continuous production monitoring for federal high-risk systems, with a verified autonomous-patch pipeline for confirmed vulnerabilities that fall into a known-safe fix class. CISA's own June 2026 risk-tiered patching directive already requires federal agencies to fix the highest-risk known vulnerabilities within three days; hitting that window at agency scale needs exactly this kind of pipeline. A human engineer stays in the loop for anything outside a known-safe fix class.
Keep policy language precise about what's being measured: a coding assistant generating insecure code is a different failure mode from a vulnerability in the AI tooling infrastructure itself, and the two shouldn't get conflated in how incidents are reported or regulated.
Calibrate any future policy threshold on independently reproducible measurement of these tools' real-world performance, treating vendor-published statistics as one directional data point among several.
Federal high-risk code should get continuous AI-assisted review, active monitoring, and fast, verified autonomous patching for confirmed vulnerabilities.
Turn frustration into useful pressure.
If this position misses evidence or a lived consequence, challenge it. If it holds up, help test it locally and connect it to the issues around it.