AI-Generated Code: The Illusion of Correctness Is More Dangerous Than a Real Bug

Too Clean to Question

96% of developers don't trust AI-generated code. Yet only 48% actually review it before pushing to production. This isn't a technical paradox. It's a human one: we know the code is suspect, but it looks so clean that we move on.

Jason Schmitt, CEO of Black Duck, coined a phrase that captures the problem well: "the illusion of correctness." Code that compiles, passes basic tests, comes with neat comments. Nothing blinks red. But beneath the polish, security flaws sit patiently, waiting to be exploited.

Three studies published in early 2026 converge on the same finding. The biggest risk with AI code isn't that it crashes. It's that it looks like it works.

Volume Outpaces Review Capacity

To understand the scale, look at production numbers. According to the Aikido study (450 professionals surveyed across Europe and the US), 24% of production code is now written by AI. In the US, that figure climbs to 29%. The Sonar survey of 1,100 developers puts it at 42% of all committed code. Projections for 2027 point to 65%.

It's like a factory doubling its production rate without adding quality inspectors. The conveyor belt speeds up, but the same tired eyes are scanning the output with the same old tools.

61% of developers surveyed by Sonar acknowledge that AI code "looks correct but isn't reliable." And 38% say reviewing AI code takes more effort than reviewing human code. The reason is straightforward: well-formatted AI code doesn't trigger the same alarm bells as sloppy, hastily-written human code. The flaws are subtler, better concealed within clean structure. The bottleneck has shifted: we no longer struggle to write code, we struggle to verify it.

1 in 5 Vulnerabilities Already Comes From AI Code

The consequences are already measurable. The Aikido study reveals that one security flaw in five is now tied to AI-generated code. 69% of surveyed organizations discovered vulnerabilities introduced by AI code in their own systems.

The Veracode report (cited by SoftwareSeni) goes further: AI code contains 2.74 times more vulnerabilities than human code. In Java, the security failure rate hits 72%.

On the behavioral side, it's no more reassuring. 44% of developers bypass security controls when they find them too restrictive. 37% straight-up ignore alerts. It's the classic reflex: when the alarm goes off too often, you eventually unplug it.

The cost is concrete. Aikido estimates that 15% of engineering time is lost to security alert triage. For a company with 250 developers, that's $1.4 million per year. Not from exploited flaws: just from time spent sorting through noise.

Europe Is Doing Better (For Now)

An interesting detail in the Aikido data: geography changes everything. 43% of US organizations report serious AI code incidents, versus 20% in Europe. That's more than double, and it can't be explained solely by heavier usage across the Atlantic.

The most likely explanation is regulatory pressure. The European Cyber Resilience Act pushes companies to structure their software security approach. The BSIMM16 report from Black Duck (111 organizations evaluated) confirms the trend: SBOM (Software Bill of Materials) adoption up 30%, automated infrastructure verification up 50%.

You could argue regulation slows innovation. You could also argue it forces organizations to verify what they deploy. When it comes to AI code, the numbers suggest it's the latter.

AI Code Will Be Reliable Someday, But Not On Its Own

96% of professionals surveyed by Aikido believe AI will eventually write secure, reliable code. The nuance is in the "how": only 21% think it will happen without human oversight. 44% place the timeline at 3-5 years.

The immediate problem is the in-between. We're in a phase where AI code volume is exploding, verification tools can't keep pace, and human behaviors haven't caught up with technical reality. A third of developers use AI tools through personal accounts, off their company's radar. It's shadow IT applied to source code: nobody knows exactly how much AI code is circulating in the company's repositories, or which tool generated it.

If you manage a team using AI coding assistants (Copilot, Cursor, Claude Code, or others), here's a concrete question to ask tomorrow: do you have a review process specifically for AI code, separate from your standard code review? Because reviewing AI code the way you review human code is like proofreading a beautifully typeset document: the formatting reassures you, and the substance slips through.