GuardrailAI: Architectural and Security Policy Enforcer for AI-Generated Code

Quality in terms of bugs has been much lower in my experience, to the extent that my team has been able to reduce our bug backlog to zero, which we wouldn’t have been able to believe a year or two ago. Most of the pushback that I’ve heard from eng teams is that architecture is what takes a hit, while there are technically lower bug counts, when AI is not kept in check major architectural decisions are sub-par and not built for the long term. That being said, my most AI-forward developers admit that even there it’s getting better than a lot of human developers, and that engineers are spending more time building the AI tools or harnesses, PR reviewers, etc… as opposed to directly building the products. But anyways, that’s a different topic. Overall, yes, we’re seeing way fewer bugs, and bud resolution time is also way faster.

I've actually been studying this exact question pretty intensely for about a month. And, the answer is a bit confusing. If you review the public research, most security researchers will claim that AI does not produce secure code. However, if you read their study methodology closely, you will see that they don't actually allow for process improvement or enhanced testing due to AI. They simply test AI code vs. human code with no changes in the development process. That clearly doesn't work. We know from DORA that AI enabled teams who don't change their process produce lower quality results. So, I decided to actually take a look and scan a group of repos. I built a tool that runs seven popular open source code scanners across a group of 400+ GitHub repos. The results were interesting. First, it is absolutely true that "AI" repos had higher numbers of security issues. On average about 15% more. However, if you look at security issues per Line of Code, the results were almost the same. Therefore, in my sample, the rate of security flaws was about the same, but the AI libraries were larger. So, yes? AI writes more code and therefore they have more issues. But, the code isn't less secure. The next thing I did was to control for automated testing. I compared AI repos with automated testing with hand coded repos with and without automated testing and it turns out that AI repos with automated testing are actually MORE SECURE than hand developed repos. So, it depends. If you change your process to require a more complete test suite (which is much easier with AI), then your code is probably just as secure as hand written code. **Caveats:** My sample is not exhaustive. 400 repos seems like quite a few, but that's a tiny sample compared to all the repos on GitHub. I also used some tests like commit messages and presence of files like Claude.md to determine if the repos were AI or not. That categorization may have flaws. I am also using only automated scanners. I am not doing a line by line analysis which means that the security assessments could be flawed if the tools have bugs or other issues.