> because AI-generated code is kind of notoriously terrible at security.

This is simply not true, perhaps it was in the past but recent models are very capable... To the point that I trust them more than humans to write secure code. It's all about the prompting. Have a step in your development pipeline whereby an LLM scans, checks, audits your code. Make it a different model/session from the LLM that wrote the code in the first place. Acts like an independent auditor.

But if AI produces code with 90% fewer vulnerabilities per line, but generates 10 times as much code, the total security exposure remains the same .