Auditing and Mitigating the Risks of 100% AI Generated Code

In March 2025, Y Combinator's Jared Friedman said the quiet part out loud: in the W25 batch, about a quarter of startups had codebases roughly 95% generated by AI, with that figure excluding library imports. The number ricocheted through r/csMajors and financial press as a productivity milestone. For anyone acquiring one of those companies, insuring one, or being asked to take one to production, it is also a liability disclosure.

This piece is for the buyer on the other side of that trade. The engineering problems with vibe-coded software are well covered. The business problems — copyright that will not attach, open-source licenses that quietly travel with model output, cyber policies that now exclude the exact failure mode, and provenance gaps regulators will ask about — are the ones that follow you into due diligence.

What "95% AI-Generated" Actually Describes

The YC figure measures keystrokes, not responsibility. It means a human prompted, a model produced, and the result was committed. It does not mean the code was reviewed, that its origin is documented, or that anyone on the team could rewrite it. Friedman himself framed the number as human-typed versus AI-typed, which is a useful operational metric and a dangerous one to confuse with authorship.

A Sonar survey of more than 1,100 professional developers makes the gap visible. Ninety-six percent said they do not fully trust that AI-generated code is functionally correct, and only 48% always verify it before committing. AI co-authored pull requests averaged 10.83 review issues each, compared with 6.45 for human-only PRs. That ratio is the technical debt you inherit when you acquire the codebase.

The Security Defects Are Now Measurable

The 2026 edition of Veracode's GenAI Code Security Report is blunt. Across their test battery, roughly 44% of AI code generation tasks introduced a risky security vulnerability, and the average pass rate across tested models was 56%, barely moved from 55% in the first report. Older research found Java particularly bad: a 72% security failure rate across tasks in the 2025 run.

The CVE curve is tracking that failure rate. Georgia Tech's Vibe Security Radar project recorded a near-sixfold increase in CVEs attributable to AI coding tools in two months, from six in January 2026 to 35 in March 2026. The tools themselves are not immune: CVE-2025-53773 was a critical command-injection flaw in GitHub Copilot and Visual Studio, CVSS 7.8, that enabled remote code execution via prompt injection by instructing Copilot to flip the IDE into an auto-approve "YOLO mode."

Prompt injection is not a theoretical concern on a slide anymore. The OWASP Top 10 for LLM Applications 2025 ranks Prompt Injection as LLM01 and names Improper Output Handling (LLM05) as the pattern where LLM output is passed to backend, privileged, or client-side functions without scrutiny. A codebase authored by a model and never scrutinized is, by definition, an Improper Output Handling case at the repository level. Our earlier piece on auditing AI-generated code before production walks through the review patterns that catch this before shipping.

Copyright You Cannot Actually Hold

The intellectual property position is worse than most founders realize. The US Copyright Office does not extend protection to purely AI-generated code; in mixed authorship, only the human-written pieces are eligible for copyright. If 95% of your codebase was emitted by a model and never materially rewritten, 95% of your codebase is not yours to defend as original expression.

That matters at three moments. First, in acquisition diligence, when the buyer's counsel asks what portion of the IP schedule is actually registrable. Second, in competitive disputes, when a near-identical competitor appears and your infringement claim rests on code you did not author. Third, in trademark and brand enforcement, where derivative UI patterns, naming conventions, and even generated marketing copy can collide with existing marks the model surfaced from its training distribution without flagging.

The adjacent risk is license contamination. Large models trained on copyleft repositories can reproduce close variants of that code in output, and verbatim copying of GPL code violates the license regardless of how it was produced. The Ninth Circuit's September 2026 ruling in the GitHub Copilot case dismissed the DMCA copyright-management-information claims on the theory that Copilot generated new code rather than stripping metadata from copies, but it did not foreclose the underlying license-breach questions. For a buyer, "unsettled" is a risk, not an all-clear.

Cyber Insurance Just Repriced This

The insurance market has moved faster than most engineering teams noticed. On January 1, 2026, the Insurance Services Office introduced generative AI exclusion endorsements for commercial general liability, and carriers began attaching them at renewal. Three endorsements shipped, including a broad generative AI exclusion and one tied to products and completed operations. Some cyber carriers are reportedly applying AI sublimits near ten percent of the policy limit, which leaves the headline number intact and quietly caps what responds to an AI-related event.

The specific wording a buyer should look for is the AI-generated code exclusion. One 2026 overview describes it plainly: losses stemming from undocumented AI-generated code outside governance frameworks are explicitly excluded, and forensic investigators flag AI-generated functions that lack code review records and audit trails as excluded losses. The practical implication is that provenance is now an insurance artifact. Without a reviewed, logged, attributable commit history, a breach that touches AI-generated code becomes an argument with your carrier before it becomes a payout.

This changes the economics of a cheap MVP. The cost to take an AI-built prototype to production now includes a governance tax, and the failure modes at scale are the ones carriers are learning to deny.

Provenance Gaps and the NIST Baseline

NIST finalized SP 800-218A, the Secure Software Development Practices SSDF Community Profile for Generative AI, in July 2024, written for producers of models, producers of systems that use those models, and acquirers of those systems. "Acquirers" is the operative word for an enterprise buyer. If your diligence does not map to SP 800-218A, you are negotiating against a standard the other side can later claim you waived.

Provenance is the thread that runs through every section above. GitHub reports its Copilot code review feature has processed over 60 million reviews, growing tenfold in less than a year, and cites a January 2026 study, "More Code, Less Reuse," finding agent-generated code introduces more redundancy and more technical debt per change than human-written code. Volume alone will outpace human review unless the pipeline records who or what wrote each change, with what tool, against what prompt, and who approved it.

A Mitigation Checklist a Buyer Can Actually Enforce

The following is the short list we apply when a client asks us to take over, scale, or acquire a codebase that was written mostly by a model. It is not exhaustive; it is the minimum that keeps the deal insurable and the IP defensible.

• Attribution ledger. Every commit records the tool, model version, prompt summary, and reviewer. Without this, your cyber policy and your copyright position both weaken.
• License-contamination scan. Run an origin scanner against the full codebase, not just new PRs. Flag anything that matches copyleft repositories at the function or snippet level.
• Human rewrite threshold. Define, in writing, the point at which generated code must be rewritten by a named engineer before merge. This is where copyright attaches and where a reviewer can be deposed.
• Secure-by-default guardrails. Map controls to the OWASP LLM Top 10, especially Prompt Injection and Improper Output Handling, and treat every path from model output to a privileged function as untrusted input.
• SP 800-218A alignment. Build the SSDF Community Profile into your SDLC rather than retrofitting it during the first incident response.
• Insurance review. Read your CGL and cyber endorsements for ISO forms CG 40 47, CG 40 48, and CG 35 08, and the carrier's AI-generated code exclusion. Negotiate the carve-backs now, not at renewal after a claim.

Teams that need help operationalizing this tend to want two things in one engagement: a code-level audit and a governance layer that satisfies carriers and acquirers. That is where our AI development practice and the broader argument for AI-assisted versus traditional development meet. The frame we use with clients is in this piece on white-label web dev: speed from a model is cheap, and auditable delivery is what you are actually paying for.

Where This Leaves a Buyer

Vibe coding is not going away. The YC founders using it are often capable engineers choosing speed over craft, and that trade is reasonable when the output is a prototype. It stops being reasonable when the prototype becomes the company. At that point, 95% model-authored code is a copyright gap, a license exposure, a growing CVE surface, and an insurance exclusion stacked on top of each other. Any one of them is manageable in isolation. Together, they are the reason a buyer should price the discount.

The practical move is not to reject AI-generated code. It is to insist that whoever ships it can tell you, per file, where it came from, who read it, and what rewrite made it legally yours. Everything above is a version of that single question.