UK NCSC Urges Safeguards as AI-Generated Code Risks Scaling Vulnerabilities
Summary
At the RSA Conference, UK NCSC leaders warned that AI-generated code could replicate existing vulnerabilities and urged organizations to embed security principles, improve legacy systems, and consider safer frameworks and memory-safe languages.
Key points
- NCSC CEO Dr. Richard Horne warned that AI tools for code development must be designed and trained to avoid introducing or propagating vulnerabilities.
- The NCSC said current AI-generated code presents “intolerable risks” for many organizations, while acknowledging its potential benefits.
- NCSC leaders urged organizations to act now rather than wait for AI-generated code to mature.
- Suggested steps include improving legacy systems, reducing technical debt, maintaining allow-lists of approved connections, and rewriting critical components with safer frameworks or memory-safe languages.
Article Details
- Event Type
- NCSC warning and guidance on security risks from AI-generated code and “vibe coding.”
- Impact
- The NCSC warned that AI-generated code presents “intolerable risks” for many organizations because it could replicate or scale existing software vulnerabilities. It urged organizations to build security into AI development tools and take steps such as improving legacy systems, maintaining allow-lists of approved connections, and using safer frameworks or memory-safe languages. The article reports no specific breach or victim.
People
David CIdentified as CTO for architecture at the NCSC; he urged organizations to implement safeguards for AI-generated code and described practical security measures.Dr. Richard HorneAs CEO of the NCSC, he called for safeguards around AI-generated code and said AI development tools should be designed and trained to avoid introducing or propagating vulnerabilities.