Free tools Windows power users keep installed
One-click scans. No signup required.
DevSecOps teams often cannot reliably tell whether code was written by a person, an AI model, or a mix of both. A JFrog study reported by BetaNews in 2024 found that 68% of respondents could not trace code origin; the headline finding was that almost 70% could not detect AI source-code origins. That is a visibility gap—not evidence that 70% of code is AI-generated.
The practical fix is to capture provenance as code is created and reviewed, then make AI-assisted changes pass the same security and approval controls as other code. A detector that guesses authorship after the fact is not a substitute for that record.
What the 2024 finding does—and does not—mean
The JFrog finding, as reported by BetaNews in 2024, describes respondents’ ability to identify or trace code origin. It does not measure the share of their repositories written by AI, nor does it show that AI-authored code is inherently insecure. Its concern is that teams may lack reliable evidence to distinguish human-written code from code produced or assisted by generative AI.
That distinction matters. A repository can contain AI-assisted code without a durable record of where assistance occurred, who reviewed the change, or which checks it passed. Conversely, an organization can have little AI-generated code and still lack a way to prove that. The study describes a reported visibility problem, not a code-authorship audit across all organizations.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
Why provenance matters to security and compliance
When teams cannot establish how a change was produced, they have less context for deciding how to review it, investigating an incident, and documenting responsibility. Provenance does not prove that code is safe or unsafe; it supplies context that security and governance controls can use.
- Security triage: Investigators can identify affected changes and examine whether AI-assisted work correlates with a vulnerability or defect cluster, rather than relying on memory or guesswork.
- Accountability: A record can identify the person who submitted and approved a change, even when a coding assistant contributed to it. Responsibility should remain with the organization and its designated reviewers, not be assigned to an opaque tool.
- Policy and compliance evidence: Teams can show what disclosure, review, and security requirements applied to a change and whether those controls ran. The JFrog study also found that 59% relied on manual processes to enforce training-data policies and 64% lacked full confidence in meeting emerging AI regulatory standards.
- License and training-data review: Origin records can help route code for the organization’s applicable legal or policy review. Provenance alone does not establish a model’s training data, code ownership, or license status.
JFrog’s 2024 findings also included 79% of respondents saying security concerns slowed AI/ML adoption or integration. These are reported survey responses, not direct measurements of incident rates or proof that poor provenance caused a particular security outcome.
How the reported picture changed by 2026
Later surveys suggest AI coding assistance has become a larger operational issue, but their figures measure different things and should not be treated as a single trend line. Checkmarx’s 2026 survey, reported by DevOps.com, said respondents estimated that 49% of production code in 2025 was AI-generated. That is a reported estimate, not a repository-wide count independently verified across the industry.
| Survey finding | What it measures | Publisher and year |
|---|---|---|
| Almost 70% unable to detect AI source-code origins; 68% unable to trace code origin | Respondents’ reported ability to identify or trace origin, not the proportion of code generated by AI | JFrog study, reported by BetaNews, 2024 |
| 49% of production code reported as AI-generated in 2025 | Respondents’ estimate of AI-generated production code | Checkmarx/Censuswide survey, reported by DevOps.com, 2026 |
| 70% reported more vulnerabilities, including 31% who reported a significant increase | Respondents’ reported vulnerability experience in the AI-development environment | Checkmarx/Censuswide survey, reported by DevOps.com, 2026 |
| 93% reported at least one breach caused by a vulnerable application; 9% said they fixed more than 90% of vulnerabilities within 90 days | Reported breach experience and remediation performance | Checkmarx/Censuswide survey, reported by DevOps.com, 2026 |
| 90% encountered workflow issues with AI-generated code; 30% had a fully governed approach to AI-assistant adoption and oversight | Reported workflow challenges and governance maturity | Black Duck/UserEvidence survey, 2026 |
The Checkmarx figures connect AI-assisted development with reported vulnerability and remediation concerns, but do not establish that AI caused those vulnerabilities or breaches. The surveys describe respondents’ answers; they are not interchangeable with controlled security tests or verified industry-wide repository measurements.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsHow to track AI-assisted code in a repository
Build a provenance trail into the normal development workflow rather than asking reviewers to reconstruct authorship later. Record the fact and scope of AI assistance, not private prompts or sensitive source material unless a documented policy and appropriate controls specifically require them.
- Set a clear disclosure rule. Define what counts as AI assistance for your organization—such as generated code, substantial code completion, or AI-produced tests—and require developers to disclose it at the change level. Keep the rule usable for mixed human-and-AI contributions.
- Capture metadata at the source. Use IDE or repository integration to attach a consistent marker to AI-assisted changes when they are created or submitted. Where automatic tagging is not available, require a pull-request field or template entry and identify it as self-reported rather than automatically verified.
- Carry the record through review and release. Preserve the provenance marker with the pull request and link it to the commit, reviewer, approval, and checks. Export relevant metadata into audit records and, where appropriate to your process, software bills of materials (SBOMs). An SBOM can document software components; it does not by itself prove who authored a line of code.
- Apply policy consistently. Route AI-assisted changes through the same required security gates as other changes. Add stricter review or additional controls when a change touches sensitive systems, data, or risk areas under your policy.
- Check whether the process works. Track missing provenance fields, review exceptions, findings, and time to remediate. Look for patterns in defects or vulnerabilities without assuming that AI assistance is the cause.
Black Duck’s 2026 survey found that 68% considered automated AI-code tracking extremely important. Yet respondents described mixed tracking practices: 40% used automated IDE or repository tagging, 38% relied on manual pull-request comments, and 16% used a third-party AppSec or AI-governance tool. Those are reported approaches, not evidence that one method alone provides complete provenance.
What security checks AI-assisted code should pass
AI assistance should not create a bypass around normal engineering controls. The checks should reflect the change’s risk and the organization’s secure-development policy; no single scanner can establish that code is safe.
- Static analysis: Check source for insecure patterns and defects before merge.
- Dependency and license review: Scan added or changed dependencies for known vulnerabilities and apply the organization’s dependency and license policies.
- Secrets detection: Search for credentials, tokens, and other sensitive values accidentally included in a change.
- Tests and build checks: Require the project’s tests and build validations to pass, and review whether generated tests actually cover the behavior that matters.
- Policy and human review: Enforce required approvals, access restrictions, and security policies; assign a qualified reviewer to evaluate the change rather than treating a tool’s output as approval.
- Remediation tracking: Record findings, owners, exceptions, and resolution status so vulnerabilities do not disappear into an untracked queue.
Checkmarx’s 2026 survey reported that only 9% of respondents fixed more than 90% of vulnerabilities within 90 days. That figure makes remediation capacity a governance concern alongside detection: finding issues is of limited value if teams do not assign, prioritize, and close them.
Best Value
How to choose an AI-code governance approach
Compare approaches by whether they create useful, durable evidence and fit the existing delivery workflow—not just by whether a product claims to detect AI-written text. Evaluate:
- Coverage: Does it capture assistance in the IDE, repository, pull request, or only one of those points?
- Traceability: Can a provenance record be connected to the relevant change, commit, reviewer, and release?
- Policy enforcement: Can required disclosures and security checks be enforced, with exceptions recorded?
- Security integration: Does it complement static analysis, dependency scanning, secrets detection, and existing AppSec workflows?
- Audit and reporting: Can the organization export records needed for internal review and applicable compliance processes?
- Human controls: Can reviewers inspect findings, approve changes, and own remediation decisions?
- Deployment and data handling: Does the integration fit the organization’s environment and its rules for code, prompts, and metadata?
Black Duck’s 2026 survey found that 84% preferred keeping a human in the loop for AI-code security evaluation. Respondents split between reviewed automated pull requests (41%) and real-time IDE suggestions (41%); 16% favored fully automated remediation in non-production environments. These preferences point to different workflow needs, not a universal best configuration. Black Duck also reported that respondents with a fully governed approach were 55% more likely to say AI coding assistants made a major improvement to efficiency (90% versus 58% overall); that is an association in the survey, not proof that governance caused the reported efficiency gain.
What a workable policy should make explicit
A policy is useful when developers and reviewers can apply it consistently. At minimum, document:
- Which kinds of AI assistance must be disclosed, and where the disclosure belongs.
- Which code, data, or systems may be used with approved assistants, under the organization’s own security and privacy rules.
- Which checks and reviewer approvals are mandatory before merge or release.
- How provenance metadata is retained, who can access it, and how audit requests are handled.
- Who owns exceptions, vulnerability remediation, and policy updates.
The objective is not to label AI-assisted code as suspect by default. It is to ensure that teams can explain how a change entered the codebase, apply the right controls, and show that a responsible person evaluated the result.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
