When hundreds of platform engineers and engineering leaders at PlatformCon London were asked this summer if they're actively using AI to write and review code, nearly all raised their hands. But when asked if they felt confident in the security systems they have to account for AI-generated code, all but two kept their hands up — a stark contrast that raises the question of whether teams should be moving at AI speed if they can't do it securely. The panel discussion, covered in a report by The New Stack, explored how AI is reshaping code security and why traditional defenses are falling dangerously behind.
The report highlighted several concerning data points about the current vulnerability landscape. In 2025 alone, a record 48,185 common vulnerabilities and exposures were published, with 20% classified as critical or high severity. Meanwhile, the EdgeScan Vulnerabilities Statistics Report found the mean time to patch or resolve these vulnerabilities was 55 days — a gap that AI-powered attacks can exploit with unprecedented speed. The panelists expressed particular worry about n-day threats: public, known, patchable vulnerabilities that organizations simply haven't addressed yet. The report also pointed to the rise of "shadow AI," where non-technical employees — such as 17 different HR professionals building 17 different AI agents for day-to-day tasks — create security risks by developing code without understanding whether it's safe.
According to Liz Rice, chief open source officer at Isovalent and a panelist, "The threat landscape has really changed a lot because finding vulnerabilities is almost wasted work now." She told The New Stack that "what we're doing in the AI world is non-deterministic, so having guardrails around what systems can do becomes ever more important because we can't predict what models are going to do next." Rice also warned that "however good your model is, it probably is not going to write absolutely secure code any more than a human does," predicting "horror stories where people write their own whatever, and it will have vulnerabilities in it." Joe Baguley, CTO of EMEA at Broadcom, stated during the discussion that "there is no such thing as a zero-day anymore" and emphasized that software bills of materials will become critical as companies begin to fork open-source projects rather than adopt them wholesale.
The report explained that organizations need runtime shields to protect themselves before patches can be applied, since AI models can now autonomously discover, chain, and exploit software vulnerabilities at scale. These shields, often built on eBPF, can safeguard file systems, prevent privilege escalations, and monitor network access — acting as dynamic, immediate protection that's faster to deploy than traditional reactive measures requiring software rebuilding and redeployment. The report also introduced the concept of an AI bill of materials to track non-deterministic components like model weights, training datasets, and third-party APIs, preventing supply chain gaps, data poisoning, and regulatory non-compliance. Rice explained these shields can take the form of guardrails to stop "vibe-coded action becoming unexpectedly wild" or CVE-specific runtime shields to detect particular exploit behavior.
Looking ahead, the report argued that platform teams can't rely on security processes from 20 years ago and must rethink how they build platforms entirely. Baguley said companies are "entering a world where it's not just about how we control agents, but it's about how you think about rebuilding platforms," calling for platforms that are "instantly patchable" and continuously updated for n-day threats — similar to how an iPhone update happens without the average user paying attention to what it does. The bottom line: already burnt-out security and site reliability engineers can't keep pace with AI-driven threats using old methods, and the answer lies in making platforms leaner, harder, and faster through runtime protection and automated, continuous patching.