AI-generated code hides malicious intent across multiple pull requests

The security threat landscape in AI-assisted development has fundamentally shifted from a code-artifact problem to a governance-and-intent problem. When human engineers write malicious code, it is rare and typically concentrated in an obviously suspicious change. But when AI assistants generate code at scale—51% of professional developers now use them daily—the attacker's strategy changes: distribute harmful objectives across multiple seemingly innocent pull requests submitted over days or weeks. Each individual change passes review cleanly because traditional code review, static analysis tools (SAST), and even custom LLM-based PR security systems all evaluate one pull request at a time. A SAST scanner is built to recognize known weakness classes like injection flaws or unsafe deserialization, and it does this well against a single diff—but it was never designed to determine whether multiple changes collectively implement a broader objective. Even organizations with well-built, enforced, LLM-assisted review can see every individual PR clearly and still miss the pattern that only appears across several of them. The blind spot is longitudinal: reviewers see one PR, CI evaluates one change, and branch protection rules make merge decisions independently, PR by PR. None of this infrastructure was built to hold a longer view or to reason about what a given account, agent, or contributor has been building over time.

For regulated industries—fintech, healthtech—the stakes are no longer confined to whether a scanner catches a known bug. The challenge is whether an organization can demonstrate consistent governance over AI-generated change. A malicious insider using coding assistants can produce smaller, faster, less suspicious-looking changes, which complicates insider-threat models that most compliance programs were built around. When something goes wrong, organizations need to know which actor, prompt, or automation path actually produced the change. Evidence must exist at the level of individual merge decisions, mapped to actual governance workflows and remediation, not as a quarterly review exercise layered on top. The industry is actively building toward cross-PR intent detection, but this remains an emerging direction, not yet a solved capability—any team evaluating tools should treat claims of full longitudinal detection with skepticism.