Informa TechTarget | SearchSecurity Cybersecurity Dive InformationWeek Channel Dive Explore our brands An Informa TechTarget Publication Dark Reading Resource Library Black Hat News Omdia Cybersecurity Advertise Newsletter Sign-Up Newsletter Sign-Up Cybersecurity Topics Related Topics Application Security Cybersecurity Careers Cloud Security Cyber Risk Cyberattacks & Data Breaches Cybersecurity Analytics Cybersecurity Operations Data Privacy Endpoint Security ICS/OT Security Identity & Access Mgmt Security Insider Threats IoT Mobile Security Perimeter Physical Security Remote Workforce Threat Intelligence Vulnerabilities & Threats Recent in Cybersecurity Topics Vulnerabilities & Threats Microsoft Reins in RoguePlanet Zero-Day Threat Microsoft Reins in RoguePlanet Zero-Day Threat by Rob Wright Jul 9, 2026 4 Min Read Identity & Access Management Security AI Agents Are a New Kind of Identity & Most Organizations Aren't Ready AI Agents Are a New Kind of Identity & Most Organizations Aren't Ready by Mora Gozani Jul 9, 2026 6 Min Read World Related Topics DR Global Middle East & Africa Asia Pacific Latin America Recent in World See All Cybersecurity Operations State IDs for AI Agents: Will Estonia Set a Precedent? State IDs for AI Agents: Will Estonia Set a Precedent? by Nate Nelson Jul 8, 2026 5 Min Read The Edge DR Technology Events Related Topics Upcoming Events Podcasts Webinars SEE ALL Resources Related Topics Resource Library White Papers Reports Webinars Newsletters Podcasts Heard It From a CISO Reporters' Notebook Dark Reading's 20th Videos Dark Reading Polls Partner Perspectives Meet the Editors Advertise With Us About Us Dark Reading Resource Library Application Security Cyber Risk Insider Threats Cybersecurity Operations News AI Coding: Do Security Risks Outweigh Productivity Gains? AI coding tools cost $19-$200/month/user, but security scanning, remediation, and false positives add hidden costs. Are the productivity gains worth it? Alexander Culafi , Senior News Writer , Dark Reading July 10, 2026 7 Min Read Source: Moor Studio via Getty Images AI coding tools have changed the software development world in a few short years, but security risks and rising costs associated with AI-generated code mean organizations should consider their potential return on investment (ROI) before jumping into the deep end. That said, many organizations have already entered the deep end. According to GitLab's 2026 AI Accountability Report published last month, 91% of organizations are using two or more coding tools, and 54% use three or more. Depending on which study you look at, results vary a bit. A Black Duck survey found AI code enterprise adoption had reached 97%. The Futurum Group said 76.6% of organizations are actively using AI in software development workflows, while another 20.4% are evaluating. In enterprise development, AI is often used to automate some of the more boilerplate, repetitive tasks developers have to contend with at work. Large language models (LLMs) can also be used to test for vulnerabilities and general code integrity, but that's not all. Some individuals choose to vibe code , which refers to the practice of using natural language to code software nearly, or entirely, wholesale. Those who vibe code may not necessarily understand how to program or how computer code works. Related: Dialogflow CX 'Rogue Agent' Flaw Enabled AI Chatbot Data Theft While the GitLab and Black Duck reports also cite developers feeling productivity gains and/or positive ROI from coding tools, that doesn't tell the whole story. SonarSource's State of Code Developer Survey 2026 collected 1,149 responses from developers around the world and found 72% of developers who tried AI coding tools use them daily. Meanwhile, developers on average felt a productivity gain of 35%, respondents said. However, 96% said they do not trust AI-generated code to be functionally correct as is, and 61% believed AI tools often produce code that looks correct but isn't reliable. That matters because while a significant amount of time is spent checking AI code overall, only 48% of developers said they always check AI generated code before committing it. Generally speaking, security experts agree that if AI assisted or generated code is being used, a skilled developer should be kept in the loop to make sure the code isn't spilling secrets or including obvious vulnerabilities that a threat actor can exploit. The Messy Intersection of AI Code and Security Which brings us to the security risks that come with AI generated code. Veracode's AI research last year claimed 45% of AI generated code samples contained OWASP Top 10 vulnerabilities, and while research disagrees on the exact percentage, vulnerable AI code remains a well-studied topic . Part of the issue is that AI models train on massive repositories and libraries of insecure code. Related: Crafty Phishing Campaigns Auto-Adapt to Victim's Device, OS In March of this year, Georgia Tech’s Vibe Security Radar project tracked 35 CVEs it could attribute directly to AI coding tools. And there's also the issue of "slopsquatting" — approximately 20% of AI-generated code samples reference packages that don't exist , and attackers publish malicious packages with those hallucinated names in order to target organizations. There's also a longstanding issue of AI-generated code spilling secrets and hardcoded credentials , and there's an entire body of research now regarding security risks (and outright attacks) linked directly to the high permission levels and loose trust boundaries present in so many AI deployments. Ben MartinMooney, product marketing manager at GitGuardian, tells Dark Reading the cybersecurity vendor is seeing more secrets leaked through AI coding tools versus traditional workflows. "The rise of AI code assistants has inadvertently contributed to the generic secrets problem. According to our research, the use of AI coding assistants increases the secrets incidence rate by approximately 40%," he says. "At the commit level, we found that Claude Code-assisted commits leaked secrets at 3.2%, versus a 1.5% baseline across all public GitHub commits, more than double the rate." Related: New Initiative Tackles Security for End-of-Life Open Source Software In cases where credentials are leaked, a full remediation takes multiple steps between rotation, coordination with service owners who rely on the credential, assessment of what the credential touched, and general cleanup, which can pull in multiple teams, MartinMooney explains. GitGuardian's value calculator put the average remediation effort to at least two engineer hours per incident of a leaked credential, and that can be much higher if the credential is live in production and spread across multiple systems. Worse, he adds, the cost is often never paid down. According to new research from the GitGuardian, 64% of leaked credentials found in public GitHub commits and confirmed valid in 2022 were still valid when tested in January 2026, "meaning they had never been rotated." Wiz this week unveiled GhostApproval , a vulnerability pattern affecting six of the top AI coding assistants, including Amazon Q Developer, Anthropic Claude Code , Augment, Cursor, Google Antigravity, and Windsurf. "In each case, a malicious repository can trick the agent into accessing arbitrary files outside the workspace sandbox, potentially achieving remote code execution on the developer's machine," researchers said. The company said AWS, Cursor, and Google fixed the issue and three had not, as of that publishing. Rik Turner, chief cybersecurity analyst at Omdia (also owned by Informa TechTarget) says he believes "we're only at the outset" of the security problem. "If human developers introduce lots of vulnerabilities into their code via open source libraries, coding agents do the same, but on steroids," he says. "I don’t know whether the labs are aiming to address this problem by steering their agents away from dodgy libraries, but to be honest, there are so many of the latter that schooling the agents and checking that the secure libraries are still secure next time they’re used may be a Herculean task too far for the labs themselves. They might have to outsource that to AppSec specialists." The AI Code Cost Quandary In discussing the security risks brought about by AI coding tools, the other elephant in the room is cost. AI usage costs are well on the rise, and a recent Gartner report claimed the increasing token costs will cause AI coding to become more expensive than the average developer's salary by 2028. The base price for AI coding tools vary, generally $19 to $40 per user, per month, before considering compliance, policy, infrastructure, and tokens once a credit cap is met (depending on the tool), among other factors. For some premium tiers or advanced platforms, the cost jumps to between $60 to $200 per user, per month. And checking AI code is no small ask, either. From a cost perspective, Chao Cheng-Shorland, CEO of operational resilience firm ShelterZoom, tells Dark Reading that security teams she's spoken with describe spending up to 40% of their time triaging findings that are ultimately non-exploitable. That can be hundreds of thousands of dollars spent "producing nothing." "Every new scanning tool added to catch AI-generated issues brings its own tax: 40 to 200 hours of integration work, 20 to 80 hours of initial false-positive triage, months of tuning before it actually earns its keep," she explains. "Treat AI-assisted development as a new category of technical debt that needs its own budget line, not a feature you bolt onto existing review." Locking down AI is expensive in its own right. The shared responsibility of data in the AI ecosystem remains complicated at best, and using AI responsibly means inventorying systems the AI touches, practicing the zero-trust model , using high quality authentication methodologies, ensuring AI tools adhere to least privil