Engineering practice
AI writes code faster, but who checks it?
AI coding assistants have shifted the bottleneck in software development from writing code to reviewing it. They also introduce new risks, including recommending software packages that do not exist until an attacker creates them.
- Lorendix research team
- Security and engineering practice
- 5 September 2026
- 6 min read
Most engineering teams now write a large share of their code with the help of an AI assistant. The productivity gains are real, but few teams have planned for the consequence. The hard part is no longer writing the code. It is being confident that the code is correct.
The bottleneck has moved
An AI assistant can produce a working feature in minutes. A reviewer still needs just as long to understand it, and often longer, because the developer who submitted the change may not have worked through every line themselves.
Teams that measure output see a clear improvement. Teams that also measure defects, security findings and review time often find that the costs appear a few weeks later.
If nobody has fully worked through a piece of code, nobody fully owns it. Code review is where that ownership is established.
A new supply chain risk
Research presented at the USENIX Security Symposium in 2025 analysed 576,000 code samples produced by 16 AI coding models. It found that 19.7 percent of the software packages the models recommended did not exist. Commercial models performed much better than open-source ones, at around 5 percent compared with around 21 percent.
In total, the models invented more than 205,000 package names. Because models tend to repeat the same invented names, an attacker can register those names in a public registry and wait for developers to install them. The technique is now known as slopsquatting.
576,000
Code samples analysed
19.7%
Recommended packages that did not exist
205,474
Unique invented package names
Spracklen et al., USENIX Security Symposium 2025.
A practical approach
Keep changes small
Ask for, and accept, changes that a reviewer can understand in one sitting. A large AI-generated change that is approved simply because the tests pass is one of the riskiest things in a codebase.
Use tests as the specification
Write or agree the tests for important behaviour before accepting generated code, so the code is checked against what you intended rather than against itself.
Check every new dependency
Treat any new package introduced by a change as a decision to review. Confirm that it exists, that it is maintained and that it is the package you meant, and automate this check in your pipeline.
Keep security scanning in the pipeline
Static analysis, secret detection and dependency checks matter even more when code is produced faster than people can read it.
Hold the developer accountable
A developer who submits AI-generated code owns it as if they had written it themselves, and should be able to explain it during review.
Sources
- Spracklen et al.: We have a package for you! A comprehensive analysis of package hallucinations by code generating LLMs, USENIX Security Symposium 2025
In short
- AI assistants move the bottleneck from writing code to reviewing it
- AI models invent package names, and attackers can register them
- Small changes, tests written first and dependency checks keep the speed gains safe
More from the practice
The packages you trust are now the ones attackers target
In 2026, attackers stopped relying on fake lookalike packages and started taking over genuine, widely used ones. Axios was compromised in March, and in August a self-spreading worm infected hundreds of npm packages. Every dependency you install is now a possible route into your systems.
Your help desk is now your security perimeter
One of the most damaging UK retail breaches of the past two years started with a phone call to an outsourced IT service desk. It is now easier for attackers to talk their way through account recovery than to break the systems it protects, and most organisations have not tightened that process.
Bring us a question your team has not been able to answer
If this article raised a question about your own systems, describe the situation rather than the solution you have in mind, and we will tell you what we would look at first.