Starting in 2022, with the proliferation of publicly available LLMs such as ChatGPT, we began to witness the rapid rise of generative artificial intelligence tools. As expected, AI has also had a profound impact on the software development lifecycle. The unprecedented productivity gains are undeniably a major part of this appeal. However, speed cannot come at the expense of security. In information security, the Zero Trust model (“Never trust, always verify”) has become a fundamental guiding principle. This same principle should be extended to software engineering, becoming an indispensable practice, particularly when building critical systems.
There is no doubt that AI drives efficiency by accelerating code generation. However, accepting its output without question poses a significant risk. A security flaw, for example, introduced into a system could lead to the leakage of sensitive information and, consequently, seriously damage the reputation of both the system and the company that provides it. From this perspective, developers need to adopt a vigilant mindset and apply Zero Trust to code generated by automated agents. This involves conducting thorough manual reviews, auditing the logic, checking for security vulnerabilities, and removing unnecessary redundancies or boilerplate that can diminish code quality.
