AI is writing code faster than anyone can check it. Inline completions, multi-file agent builds, it all lands in main branches before a human really looks at it. I went looking for hard numbers on this and found GitClear’s analysis of over 200 million lines of enterprise code, which shows a sharp jump in duplicate blocks and short-term churn wherever teams lean on AI assistance.
That’s not just a volume problem. Code that compiles looks finished. It isn’t.
The 2.7x Number Nobody’s Budgeting For
A Cloud Security Alliance research note on AI vulnerability debt puts a figure on the gap: AI-assisted pull requests carry up to 2.7 times more security flaws than code written by hand.
Developers judge code by whether it runs, not by what’s underneath it. A model can hand back clean syntax on the first try and still be smuggling in a hallucinated package import or an insecure logic branch that maps straight onto the OWASP Top 10. None of that shows up when you hit run. It shows up later, in review, or months down the line when someone finds the exploit in production.
Where the Cost Actually Lands
Productivity gains from AI coding don’t just shrink under this pressure. They can flip negative. A team that hits a wall of unverified code right before a release burns the exact time it thought it had saved, and the ROI story falls apart. Skip the inspection and you haven’t saved time, you’ve borrowed it, with interest.
Reviewers feel it first. Ask a senior engineer to sanity-check a thousand lines an agent wrote in ten seconds, and you get one of two outcomes: hours lost picking apart machine-written logic, or a rubber-stamped approval because the queue’s too long to do it properly. Either way, the review step stops doing its job.
Licensing is the quieter risk, and it’s the same territory software composition analysis was built to cover. Models will happily output code under a restrictive copyleft licence, or reference a package that doesn’t exist and gets typosquatted by an attacker. Teams find this out during an audit, well after the code’s already shipped, which is exactly the wrong time to find out.
Catching the Problem at the Point It’s Created
The fix isn’t more review later. It’s verification earlier, right inside the editor, at the moment the code gets proposed. That’s what an MCP-based security layer does: it sits between the AI assistant and live vulnerability intelligence, checking what’s been generated against known flaws and licence terms before anyone hits accept.
Any problem gets routed straight back to the assistant, so it can patch the issue before the diff reaches a human reviewer. Pull requests show up already validated, which is the whole point. Black Duck Signal is one tool doing exactly this: an active MCP agent that checks and remediates code in the IDE before it ever reaches Git.
Black Duck Partner | Application Security Solutions | Contact us
Sign up for our newsletter | Black Duck
