The question is no longer "Is AI dangerous?" — it's "Who verifies the code AI writes, and how?"
The Wrong Question
Discussions around AI coding often get stuck on one point:
"Is AI dangerous?"
But that framing misses the real issue.
What we're actually dealing with is this:
AI coding = a new software supply chain risk
This isn't hypothetical. Supply chain attacks have already happened — repeatedly.
SolarWinds. Codecov. event-stream. ua-parser-js. xz-utils.
Each of these incidents followed the same pattern: malicious code delivered through a trusted path.
AI doesn't introduce a new category of risk. It changes the scale, speed, and entry point of an existing one.
What Actually Changed
Traditional supply chain attacks had a built-in constraint: infiltration was difficult.
Attackers had to compromise:
a dependency
a maintainer
or a build pipeline
That difficulty was the defensive barrier.
AI coding removes much of that friction.
| Factor |
What changed |
| Scale |
A single developer can generate hundreds of lines or entire modules in minutes |
| Speed |
Idea → prototype → deployable code within a day |
| Ambiguous origin |
Commit history doesn't distinguish human-written vs AI-generated code |
| Review breakdown |
Code review was designed for small diffs, not machine-scale generation |
This leads to an uncomfortable but necessary question:
How much of AI-generated code do we actually understand?
In many cases, the honest answer is: not much — it works, so it ships.
It's Fine Today. But What If—
Most AI-generated code today is harmless.
But the risk isn't about today's average case. It's about what can be hidden inside normal-looking code.
Well-known attack patterns already exist:
Time-based triggers — activates after a specific date
Environment-based triggers — runs only in production
Conditional exfiltration — executes only for specific users or flows
Poisoned dependencies — model suggests compromised packages
Dormant backdoors — behaves normally until externally triggered
These patterns don't look suspicious in isolation. They pass tests. They pass reviews.
They look like ordinary code.
Why Enterprises Hesitate: Outbound Risk
Before going further, it's important to be precise about one thing.
The primary reason enterprises hesitate to adopt external AI coding tools is not supply chain risk.
It's data leakage.
Internal source code is sent to external model providers
Architecture, schemas, and business logic are embedded in prompts
Sensitive data (PII, customer info, trade secrets) may leave the organization
From a security standpoint, this is a clear boundary issue:
If you cannot control what leaves your system, you cannot safely adopt the tool.
This concern is valid — and it's where most enterprise discussions stop.
The Problem: Control Breaks When You Only Focus Outbound
Most current defenses focus on preventing data from going out:
All of these are necessary.
But they share a limitation:
They only address one direction.
So what happens next?
When official paths are restricted, usage rarely disappears — it shifts.
In many organizations, developers still experiment with AI tools outside sanctioned environments, especially under delivery pressure.
The resulting code can re-enter through unmanaged channels:
personal devices
private storage
manual copy-paste
At that point, the issue is no longer just policy.
It becomes a loss of traceability.
The system can no longer answer a basic question:
Where did this code come from?
This Is a Governance Problem
This is not just a security tooling issue. It's a governance gap.
Three questions remain unresolved:
1. Who verifies AI-generated code?
Developers are optimizing for speed
Reviewers cannot realistically audit machine-scale output
Scanners only detect known patterns
2. Where does accountability sit?
AI vendors disclaim responsibility
Developers didn't fully author the logic
Organizations allowed the workflow
3. What defines "trusted code"?
Passing tests? → insufficient
Code review? → does not scale
Static analysis? → pattern-limited
The missing concept here is verifiable origin
The Missing Layer: Inbound Validation
Most existing tools operate under a shared assumption:
The code is already inside the repository
But in the age of AI coding, the critical question comes earlier:
Should this code be allowed in at all?
This is where most organizations have a blind spot.
What's missing is a controlled inbound pipeline.
At minimum, that pipeline needs to answer different trust questions at different layers:
| Layer |
Question |
Method |
| Identity |
Who produced this code? |
Cryptographic signatures (e.g., Ed25519) |
| Integrity |
Was it altered in transit? |
Hash verification (SHA-256) |
| Quarantine |
Is it isolated before trust is established? |
Staged ingestion (pending → scanning → accepted) |
| Scanning |
Does it match known malicious patterns? |
Semgrep, CodeQL, secret scanners |
| Attestation |
Did a human explicitly approve it? |
Optional approval gates |
| Audit |
Can we trace how it entered the system? |
End-to-end logging |
Each layer answers a different question.
Skip one, and you create a gap.
This Isn't About Better Scanning
Tools like Semgrep, Snyk, and CodeQL are effective.
But they all operate after ingestion.
They assume:
"The code is already trusted enough to exist inside the system."
AI changes that assumption.
The problem is no longer just:
"Is this code safe?"
It becomes:
"Is this code even admissible?"
A Necessary Shift
Blocking AI tools doesn't eliminate risk. Unrestricted usage doesn't control it.
What's needed is a third approach:
Allow — but verify Accept — but require proof Move fast — but preserve origin
One Last Question
In high-pressure situations — whether economic, competitive, or geopolitical — the assumptions we rely on during normal times tend to break.
At this moment, across many organizations, AI-generated code is already entering internal systems without a consistent standard of verification.
Which raises a simple but uncomfortable possibility:
The most effective path for introducing a Trojan horse may not be an external attacker — but an unverified internal entry point.
Not because individuals are malicious.
But because the system doesn't require proof.
This is no longer just a tooling problem.
It's a question of how modern software systems establish trust.
leeh — A one-way secure inbound pipeline for AI-generated code Sign → Scan → Quarantine → Audit
