AI
The Business Pressure Behind AI Code Generation
Digital transformation over the last 15 to 20 years has pushed every business to deliver software faster. Finding skilled developers remains hard regardless of geography or compensation. McKinsey estimates AI-driven product development and code automation will produce close to a trillion dollars of economic impact over the next six to seven years. Tools like GitHub Copilot, Tabnine, Google Codey, AWS CodeWhisperer, and Codeium are already deployed across private and public sector organizations, with more vendors still in stealth mode.
Evaluating Vendors Against Your Stack
Before picking a vendor, Salhotra recommends defining success criteria specific to your organization’s stack. Track latency of results, code quality, and whether the model can explain its choices. Check IDE support (IntelliJ, Eclipse), language coverage beyond C++ and Java into Go, infrastructure-as-code support, and metrics dashboards showing bug introduction rates. Annotation support records which engine generated a snippet and when, giving auditors concrete evidence in a future review.
Free Tier vs. Enterprise and IP Indemnification
Free tiers are for experimentation only. Once generated code goes near production, use an enterprise plan. Enterprise tiers typically include fine-tuning on your specific codebase, admin controls for usage tracking, single sign-on, and IP indemnification. One attendee’s company bought an enterprise license precisely because it shifts legal liability to the vendor if copyrighted code surfaces. Salhotra adds a caveat: a small vendor facing 15 simultaneous lawsuits may exhaust its reserves before your claim is settled, so vendor size and financial backing matter.
Seven Risks Worth Tracking
Salhotra catalogs seven risk categories. Package hallucinations drew more than ten hands in the room. Audience members confirmed seeing injection vulnerabilities produced directly by code generation tools. Sending proprietary source code to an external API for completion creates a confidentiality exposure. Infrastructure-as-code support lags: one attendee found more bugs in IaC output than in regular application code. Token limits cause models to stall on large files, requiring manual chunking. Over-reliance on AI tools is the longer-horizon risk most attendees shared.
Building a Mitigation Control Set
An enterprise-wide code generation policy establishes accountability before any incident occurs. Start with a small pilot group on non-critical applications, not client-facing ones. Run all generated code through your existing SAST, DAST, and regression testing pipeline before treating it as clean. Prompt quality matters: clear, context-rich prompts produce better output than vague requests. Annotate every AI-generated snippet with the engine name, timestamp, and developer identity. If a copyright lawsuit arrives, that record proves where the code came from.
What Code Generation Gets Right and Wrong Today
Test coverage and documentation show the clearest gains. Complex scenarios require multiple iterations. Performance of generated code depends on what you ask for: explicitly requesting performant code produces measurably better results, and feeding existing code back to the model with that request yields further improvement. SDLC controls still apply regardless: regression testing, functional testing, and security scanning cannot be skipped because the code arrived from an AI tool. The consensus in the room was that fully autonomous coding is five to ten years away, not two.
Q&A
How are organizations actually using code generation tools today? One attendee’s policy prohibits direct copy-paste from AI output; developers treat it as a reference guide to understand patterns, then write the code themselves, citing IP and licensing concerns. ▶ Watch (19:53)
What about the risk of sending proprietary source code to external services? Attendees flagged confidentiality exposure when source code leaves the organization, raising interest in locally hosted LLMs as an alternative that avoids exfiltration at the cost of expensive hardware. ▶ Watch (33:14)
Who bears responsibility when AI-written code causes an incident? The developer who commits the code is accountable, per Salhotra; an enterprise-wide code generation policy makes that expectation explicit, though agentic AI that commits autonomously complicates the question. ▶ Watch (36:17)
Notable Quotes
I use it as a guide Attendee · ▶ Watch (20:04)
this is something that we got from XY and Z Aruneesh Salhotra · ▶ Watch (17:11)
it’s like working with a junior Attendee · ▶ Watch (36:04)
Key Takeaways
- Use enterprise-tier plans for production code; free tiers lack IP indemnification and admin controls.
- Annotate every AI-generated snippet with the engine, timestamp, and developer for legal and audit traceability.
- Package hallucinations and injection vulnerabilities are real; generated code needs the same SDLC controls as human code.
About the Speaker(s)
Aruneesh Salhotra is a technologist and servant leader with expertise spanning cybersecurity, DevSecOps, AI, business continuity, audit, and sales. He leads two independent research groups focused on generative AI and quantum computing, contributed to “97 Things for AppSec Leaders,” and co-leads the OWASP LLM Top 10 supply chain section. He also serves on the leadership team for the OWASP AI Exchange.