AI coding tools now generate code faster than engineering teams can review, test, or fully understand it. The result is a widening gap between how fast software gets written and how carefully it gets reviewed.
Veracode’s latest GenAI code security update, published in October 2026, found that AI models still failed its security tests about 38% of the time. Meanwhile, AI already generates roughly half of all committed code, according to DX, so that failure rate reaches a growing share of production software. An independent analysis pointed the same way. IOActive’s April 2026 whitepaper found that nearly a third of AI-generated code samples were fully exploitable.
That is how code review stops doing its job. JD Raimondi, Chief AI Architect at software consultancy Making Sense, called it “approval theater.”
A developer reviews AI-generated code without understanding every decision behind it. The code runs, so it gets approved. Vulnerabilities, architectural flaws, and unintended privileges can slip through unnoticed. The company believes the code has been properly reviewed, when the review never went past the surface.
When AI coding outpaces engineering oversight
Making Sense is hosting a free webinar for CTOs and engineering leaders who oversee AI-assisted development, Uncover the Hidden Risks of AI-Coded Software. The 30-minute session takes place on Monday, November 16, at 2 PM EST/11 AM PST, followed by open Q&A. Raimondi will lead it with Mariano Jurich, Forward Deployed Product Manager at Making Sense, who has spent more than a decade building digital products.
The session starts from a simple premise. Not every risk in AI-coded software deserves the same level of concern. Some, like duplicate code or missing tests, are common but recoverable. Others are rare but severe, such as an agent with excessive permissions wiping production data. The webinar aims to help leaders tell the two apart and decide where to focus first.
The risks security tools may not see
According to Making Sense, some risks slip past scanners and basic checks. An AI agent with far more access than it needs can run for weeks without incident, until a single wrong command deletes production data. The code looks fine, and a security scan may never flag the problem. The speakers will show how to assess these risks within a team’s own processes, looking at what agents can access, how changes get reviewed, and where monitoring falls short.
If nobody reads the code, who owns it?
AI speeds up how code gets written, but responsibility for that code stays with people. Making Sense said engineering teams were adopting AI coding tools faster than their review processes could adapt, and when nobody really reads the code, nobody really owns it.
That gap shows up in everyday questions. Who reviewed this change? Why was the agent allowed to touch this data? Can anyone on the team explain why the system works the way it does? When those answers are missing, a problem that starts in engineering quickly becomes a business problem.
Registration is free and includes the AI-Coded Applications Risk Catalog, the research behind the session. Live attendees will also receive the recording and a copy of the slides.
Disclosure: This article mentions a client of an Espacio portfolio company.
