AI Code Generation Creates a Security Speed Crisis

Google Just Shipped the Problem and the Solution in the Same Press Release

Google announced two AI models on Wednesday. One writes software. The other hunts the bugs the first one creates. They launched together, same day, same company—like selling you the arson and the fire insurance in a single transaction.

Chrome's own engineering director just called the last few months a "vulnerability apocalypse." Not my words—theirs. A hockey-stick surge in security flaws, driven by AI writing code faster than any human team can review it. So Google built an automated cleanup crew and shipped it right alongside the mess-maker.

If that doesn't crystallize where we are in the AI cycle, nothing will.

I've watched this pattern play out three times now—once with the internet, once with mobile, once with cloud. Every cycle starts the same way: the new thing makes creation radically cheaper and faster, everyone celebrates the productivity gains, and six months later we're all standing in the rubble asking why nobody saw the downstream consequences coming.

We saw them coming. We just didn't want to do the math on what it meant for our controls.

The 13-Year-Old Bug Nobody Found

Here's the part that should make every CIO uncomfortable: Google's patch model found a vulnerability that sat in Chromium for thirteen years. The same codebase that hundreds of Google's elite engineers—legitimately some of the best in the world—reviewed, audited, and shipped.

Taste didn't fail. Judgment didn't fail. Throughput did.

A machine reviewed code at machine speed and found what humans missed at human speed. That's not a failure of diligence. It's a category error in how we've been thinking about software review.

Humans read code at the pace humans read. Machines write it at the pace machines write. The gap between those two speeds is where the vulnerabilities now live—and that gap is widening every quarter.

Your Change Control Process Has an Expiration Date

Every change control framework I've seen in the last eighteen months was built for a world that no longer exists. Code gets written by humans, reviewed by humans, shipped at human speed. The bottleneck was always authorship, so we built gates around deployment.

Now the bottleneck flipped.

AI generates code faster than any review process can handle. I was working with a client last month—financial services, mature security practice, the kind of shop that does everything by the book. Their security team reviews every commit before it hits production. It's worked for a decade.

I asked them: "What happens when your developers start shipping ten times the volume because they're using AI copilots?"

Long pause.

"We'll need more reviewers."

That's the sentence that loses you the next cycle. Antivirus already ran this exact play. Once malware got automated in the early 2000s, signature-based detection collapsed under volume. A human analyst reading threats off a queue stopped being diligence and became the hole in the wall. The vendors who survived sold automated defense. The ones who just hired more analysts went out of business.

Offense is already running AI. Most defense is still staffed like it's 2023.

The Asymmetry That Kills You

The math on this is brutal, and it's worth sitting with how brutal it actually is.

An attacker needs to find one exploitable flaw across millions of lines of code. You need to find every single one. That asymmetry has always existed, but when both sides operated at human speed, you could at least keep pace. Now offense is automated and defense is still running manual review.

You're bringing a calculator to a supercomputer fight.

I'm not saying human review disappears. I'm saying human review as your primary control is now a gap, not a safeguard. It's the thing you do after the automated tools run, not instead of them.

That's the uncomfortable question nobody wants to ask in a security planning meeting: if we're not automating defense at the same speed we're automating development, what exactly are we defending?

We Perfected the Automation. We Forgot to Automate the Defense.

Google shipping both models in the same announcement is almost too perfect. It's the entire tension in one press release. Yes, AI makes us faster. Yes, it introduces risk at a scale we've never managed before. Yes, you need both the productivity tool and the defensive tool, and if you only buy the first one, you just opened a gap you can't staff your way out of.

I've lived through enough of these cycles to know what happens next. Six months from now, there will be a major breach tied to AI-generated code. Someone will testify that "we reviewed everything before it shipped." The postmortem will show they reviewed 11% of it, because that's all the humans could handle, and the flaw was in the other 89%.

Nobody gets fired for following the process. They get fired when the process becomes the vulnerability.

What This Means Monday Morning

So here's what I'd ask your security and development teams this week:

Is your defense running at the same speed as the code you're now shipping? Not aspirationally. Right now. If your developers are using AI coding assistants—and they are, whether you've approved them or not—how are you reviewing that output?

"We'll review the AI-generated code before it ships" is not a control if you can't review it all. It's theater.

What automated tools are running in your pipeline today? Static analysis? Dynamic testing? Fuzzing? If the answer is "we're evaluating options," you're already behind.

Who owns the gap between development velocity and security review capacity? If nobody has that written into their goals, it's not getting solved. This isn't a tools problem. It's a throughput problem that looks like a tools problem.

The companies that win the next cycle won't be the ones with the best manual review process. They'll be the ones who automated defense before offense got too far ahead.

But what do I know—I've only watched this movie three times before.

---

Want to talk through what this looks like for your team? I work with finance and professional services firms navigating exactly this transition—where AI productivity tools collide with audit requirements and nobody's sure what the control framework looks like anymore. Reach out if you're building this and want a sparring partner who's seen the previous cycles.