Generated Code Adopted Without Developer Review
開發者未審查即採用生成程式碼
Operation & Monitoring
Risk Description
When under delivery pressure, a team adopts generated code extensively while review becomes a formality; due to unmitigated control gaps, after release, multiple defects of the same type are found, all from unexamined generated fragments, and remediation costs far exceed the review time originally saved, triggering compliance exposure and operational reputational costs.
Framework Mappings
NIST AI 600-1Information Security
NIST AI RMFMEASURE 2.7
ISO/IEC 42005影響評估流程
ISO/IEC 5338運作與監控
MIT AI Risk RepositoryDomain 5
Risk Treatment & Implementation Guidance
Subject AI-generated code to substantive review, prohibiting perfunctory review under delivery pressure; Integrate security scanning in the pipeline so generated fragments pass before merge; Train developers on security awareness and their review responsibility for generated code