Is your AI coding assistant introducing vulnerabilities into your infrastructure pipelines?

AI coding assistants have moved from curiosity to daily habit faster than most security practices can follow. GitHub Copilot crossed 1.8 million paid subscribers in 2024, and by most estimates 85% of engineering organisations are using AI in some part of their development cycle. The productivity case is real. The security case is more complicated, and if your team is generating Terraform, Kubernetes manifests, or CI/CD pipeline definitions with an LLM, the complications land directly in your most sensitive attack surface.

This post lays out what the research actually shows, where the risk concentrates in infrastructure workflows specifically, and what a concrete review framework looks like for teams that cannot afford to find out the hard way.

The numbers are worse than the headlines suggest

A September 2025 Apiiro study of Fortune 50 enterprise repositories found that AI-generated code was introducing over 10,000 new security findings per month by June 2025, a roughly 10x spike in six months. Privilege escalation paths jumped 322% and architectural design flaws spiked 153%. These are not typos and missing semicolons; they are structural problems that survive superficial review.

The Veracode 2025 GenAI Code Security Report, which tested more than 100 LLMs across four languages, found AI-generated code contains 2.74 times more vulnerabilities than human-written code, with a 45% failure rate on secure coding benchmarks. A CodeRabbit analysis of 470 open-source pull requests found AI-authored code produced 1.75 times more logic and correctness errors and 1.57 times more security findings than human-authored equivalents. An ACM study of GitHub Copilot specifically found that around 30% of generated snippets carry security weaknesses spanning 43 distinct CWEs, including CWE-330 (insufficient randomness), CWE-94 (code injection), and CWE-79 (cross-site scripting). Even after Copilot improved, the vulnerable suggestion rate dropped only from 36.54% to 27.25%.

One number that rarely appears in the productivity pitch: repositories using GitHub Copilot leak at least one secret at a rate 40% higher than those without AI assistance, with 6.4% of such repositories exposing credentials.

Infrastructure-as-code is the weak point nobody is talking about

General code vulnerabilities are bad. IaC vulnerabilities are worse, because a misconfigured Terraform module or a permissive IAM policy does not just affect one application; it shapes the blast radius for everything running on top of it.

Research published in early 2026 tested GPT-4o and Gemini 2.0 Flash against 89 vulnerable synthetic IaC scenarios. Only 7% of generated scripts were secure. Adding an explicit instruction to generate secure code raised GPT’s secure output rate to 17%; Gemini moved from 7% to 8%. For security smell detection on real-world GitHub repository scripts, a general prompt left more than half of the smells undetected. Even with structured guidance, at least a third of smells were missed.

None of the current state-of-the-art LLMs for code generation are specifically optimised to enhance security in generating IaC code. Many weaknesses cannot be resolved without additional information from users, and most developers use the generated code directly without understanding the potential flaws present.

The practical consequence: an engineer who prompts an LLM for a quick S3-equivalent bucket policy, an IAM role, or a Kubernetes RBAC manifest and applies it without review has a roughly 93% chance of shipping something with a security smell, and a meaningful chance of shipping something with an active privilege escalation path.

Novel attack vectors that bypass normal review

Beyond the quality of the generated code itself, AI coding tools introduce attack surfaces that did not exist before.

Rules File Backdoor (Pillar Security, March 2025): Attackers insert hidden Unicode characters into configuration files consumed by tools like GitHub Copilot and Cursor. The assistant reads the file and produces malicious output that looks clean to a human reviewer. GitHub added warnings for hidden Unicode text in May 2025, but the pattern illustrates that the AI’s input surface is now part of your threat model.

Prompt injection into CI/CD: In December 2024, attackers exploited a GitHub Actions pull_request_target misconfiguration to inject code into a build pipeline and publish malicious packages to PyPI. The Ultralytics incident followed the same structural pattern: CI/CD trigger abuse leading to credential theft. As AI agents are granted more autonomy over pipeline steps, the natural language prompt becomes an injection vector alongside the code itself.

Slopsquatting: A 2025 study found that nearly 20% of packages recommended by LLMs do not exist, and 43% of those hallucinated names repeat consistently across queries. Adversaries can register those names, wait for a developer to follow the AI’s recommendation, and insert a malicious dependency into the supply chain without any code review catching it.

Training data extraction: Researchers demonstrated that carefully crafted prompts can cause Copilot to surface credentials from its training data. If your organisation’s private code was ever part of a training corpus, that is not a theoretical concern.

A concrete review framework for infrastructure pipelines

The answer is not to ban AI assistants; the productivity gains are real and the tools are not going away. The answer is to treat LLM-generated infrastructure code the way you would treat code from a junior contractor: useful, fast, not trusted without verification.

• Gate IaC on static analysis, not just linting. Tools like Checkov, tfsec, and Semgrep have IaC-specific rulesets. Make them mandatory in CI before any plan or apply step. A failed scan blocks the merge; it does not open a ticket for later.
• Enforce least-privilege review on every generated IAM and RBAC block. Privilege escalation paths were the fastest-growing vulnerability class in the Apiiro data. Every role, policy, and binding that an AI produces should be reviewed against the principle of least privilege by a human who understands the blast radius, not just the syntax.
• Scan for secrets before commit, not after. Integrate secret scanning (GitLeaks, Trufflehog, or your platform’s native tooling) as a pre-commit hook and a CI step. The 40% higher secret exposure rate in AI-assisted repositories is not acceptable in any regulated environment.
• Audit your dependency graph on every AI-suggested package. Before any pip install, npm install, or equivalent that originated from an LLM suggestion, verify the package exists in the canonical registry and check its publication history. Slopsquatting is a supply chain attack that costs an attacker almost nothing to execute.
• Treat AI configuration files as part of the attack surface. Rules files, prompt templates, and assistant configuration that live in your repository should go through the same review process as code. Hidden characters in those files are now a documented attack vector.
• Log and attribute AI-generated code explicitly. The 11% of teams that know AI is being used but are not monitoring it are the teams most likely to be surprised. Require engineers to flag AI-generated code in commit messages or PR descriptions. This is not a blame mechanism; it is a signal that triggers the appropriate review depth.

Where network architecture intersects with pipeline security

One dimension that gets less attention in the AI code security conversation is what happens when a misconfigured pipeline reaches a production environment with direct hyperscaler peering. We operate 44 points of presence across Europe and the Middle East, with direct peering to AWS, Azure, GCP, Oracle, and Cloudflare at all sites. That connectivity is an operational advantage, but it also means a misconfigured IAM policy or an overly permissive security group generated by an AI assistant and deployed without review can expose a much wider lateral movement surface than it would in an isolated environment. The blast radius of a privilege escalation finding is not just the local cluster; it extends to every peered network reachable from that misconfiguration. That is the operational consequence that makes IaC review non-negotiable rather than aspirational.

The review burden is the point

The Apiiro data noted that AI assistants tend to pack more code into fewer pull requests, making review harder because changes touch more of the codebase at once. This is the structural tension: the tool that increases velocity also increases the cognitive load required to review its output safely. Accepting that tension honestly, rather than assuming the AI is handling security because it handles syntax, is the starting point for any team that wants to use these tools without shipping the vulnerabilities alongside the features.

LLM-generated infrastructure code is useful. It is also, by the numbers, significantly more likely to introduce privilege escalation paths, secrets exposure, and architectural flaws than code written by a practitioner who understands the environment. The framework above does not eliminate that risk, but it makes it manageable, which is the standard your production pipelines actually require.