The 2.74x problem: AI code ships with far more security holes than humans write

AI didn't just make your team faster. It made your code up to 2.74x more likely to ship a security hole, and the reason is exactly why nobody catches it in review. That figure comes from CodeRabbit's analysis of 470 real GitHub pull requests, and if you have shipped anything with an AI assistant lately, it probably tracks with a feeling you already had. Somewhere in that clean-looking diff, the model skipped the null check or the auth guard or the input validation a careful engineer would have added without thinking.

Here is why it slips through. The whole point of AI coding is that you no longer need to be an engineer to build something real, which means a huge and growing share of AI-generated code is being shipped by people who could not review it for security if they tried. They can tell the app works. They cannot tell that the endpoint is wide open, because reading code for what is dangerously missing is a specialized skill most builders were never expected to have. And even the engineers who do have it are working against the grain, because AI code reads beautifully and the flaw is usually not a mistake you can spot but a check that was never written at all.

What stands out in the data is how ordinary those failures were: improper password handling, insecure object references, missing guardrails. Nothing exotic, just the absence of basics that used to be automatic. AI writes code that pattern-matches to correct, so it looks like the thousands of secure examples it trained on right up until the point where it quietly drops the one piece that made them secure.

None of this is an argument against AI coding. We use it, and so does everyone building at any real speed. The shift nobody priced in is what happened when code volume jumped 10x. What made code trustworthy was an engineer who understood the whole system and held it in their head, and that understanding is now stretched thin across far more lines than any team can actually review at the speed AI produces them.

The way out is to stop trusting the source and start testing the running system. Point real adversarial traffic at it and watch what actually breaks, because behavior is the only ground truth you get. Everything you infer from reading the code is just a guess about how it will behave.

The teams that come out ahead over the next few years will not be the ones who slow AI down. They will be the ones who built a way to trust its output without slowing down at all.