Testing AI-Generated Code: Why It’s Now the Delivery Bottleneck

Before AI assistants, engineers read every line of code because they typed it. Ownership was natural. Now, they feel less of a connection with the code they submit—although, of course, they are formally responsible for it.

When a machine writes the code, engineers often assume someone will check it later in the process. Usually, nobody does.

The task of checking AI-written code was never assigned to a person or a team. Companies purchased AI tools to write code faster but left their testing and checking processes unchanged.

The Code Is Less Secure than Executives Realise

Four findings highlight the problem.

• Veracode, a security-testing firm, has tested more than 150 AI models on 80 programming tasks. About 45% of the code failed the company’s security tests. Code written in Java—a very common language in corporate systems—had a 71% failure rate across tasks.
• About a third of AI-written Python code and a quarter of AI-written JavaScript code on GitHub contain known security flaws.
• DORA, Google Cloud’s annual study of software delivery, noted in 2025 that while AI helps teams finish work faster, it also causes more software releases to fail if the checking process cannot keep up with the writing speed.
• Code that has not been properly checked becomes a risk. Engineers avoid updating it because they do not understand how it works—which quickly creates outdated, problematic software systems.

Testing Is Now the Bottleneck

If companies measure software development speed based on shipping dates, AI has made all companies faster. But if they measure how fast they can deliver features that work and are secure, the speed advantage shrinks. The time saved in writing is lost because three times as much code is now waiting in line to be tested.

It is now the testing team that controls how fast a company can deliver working software.

Speed Requires Safety Measures

A fast car needs lanes, markings, and speed limits to be driven safely. In just the same way, AI-generated code requires automated testing.

The problem is that the code usually looks correct at a quick glance, which encourages developers to approve it without review. This in turn means AI that writes code without automated checks on its work will generate problems very fast.

Automated testing is the only practical way to manage AI coding tools safely because the tools perform to the standard of the tests and rules they are subjected to.

Also consider that the longer a software defect goes unnoticed, the more it costs to fix it. Companies that test every change immediately—which is only possible with automated testing—will ultimately release more software and spend less money than companies that do not.

Three Immediate Steps to Take

Assign responsibility: Give one person the authority to stop bad code from being released. Fix the gap in responsibility by making it someone’s official job to check code.

Treat AI code like third-party code: The National Institute of Standards and Technology (NIST) advises treating AI-generated code like code purchased from a vendor. Consider that vendor code—including code that “looks OK”—gets scanned and tested before it is trusted.

Test changes immediately: Catching errors early saves time and money; test every code update as soon as it is submitted, rather than waiting until the end of a project.

The Gap Is in How Companies Are Organised

The World Quality Report notes that 43% of companies are experimenting with AI in testing, but only 15% are using it across the organisation. In our experience, that gap comes from how teams are organised, not from a shortage of tools, which is why buying more tools rarely closes it.

The companies that close it will stop treating testing AI-generated code as a final step and start treating it as the system that makes AI-speed delivery possible. That means a named owner, automated checks on every change, and the same scrutiny for AI-written code as for any code from outside the company.

Companies have handed the writing of software to machines. The ones that pull ahead will be those that decide, deliberately, who checks the results.