A product lead at a mid-market SaaS company described it plainly in a recent debrief: an engineer had used an AI coding assistant to prototype a new billing settings screen over a weekend, it looked good enough in the demo, and by the following sprint it was live in production, unreviewed by anyone in design. Nobody made a bad decision on purpose. The tool made shipping fast enough that the usual checkpoints, the ones that used to happen because writing the code took long enough for someone to notice, simply got skipped.
That story is not unique to SaaS. Aero hears versions of it across biotech portals, fintech dashboards, professional services intranets, and media publishing tools: AI-generated code moving from a quick internal experiment to something a real customer touches, without passing through the same product and design scrutiny that hand-written code used to get almost by default.
The scale of this shift is not anecdotal. Veracode tested code from more than 100 large language models for its 2026 GenAI Code Security Report and found that AI-generated code's security pass rate has stalled at 56 percent, meaning newer, more capable models are not writing meaningfully safer code than older ones, according to Veracode's own report. At the same time, developers are relying on these tools more, not less. Stack Overflow's own research describes a widening "AI trust gap," where adoption of AI coding tools keeps climbing while developers' confidence in the accuracy of what those tools produce is not keeping pace, according to Stack Overflow's own analysis.
Most organizations that have responded to this at all have responded with a security lens: static analysis, dependency scanning, a policy requiring a human to review anything AI-generated before merge. That is necessary and worth doing. But it misses the half of the problem that shows up in a browser instead of a vulnerability scanner. AI-generated code can be free of SQL injection and still be wrong for the product: a form that does not match the design system's spacing tokens, an error state that was never designed because the model did not know one was needed, a component that works but does not meet the same accessibility bar as the rest of the interface. Security review answers "is this safe to run." It rarely answers "is this the product we meant to ship."
Two companies, one a fintech operations platform and one a professional services scheduling tool, both let engineering teams use AI coding assistants to build client-facing features this year. The fintech team treated AI-generated code the way it had always treated a quick internal script: useful, low stakes, ship it if it works. Within two quarters, the product had three different button styles doing the same job, a settings flow that skipped the confirmation pattern used everywhere else in the app, and a support queue full of tickets about a date picker that behaved differently than the one on every other screen. None of it was insecure. All of it read, to users, as a product that did not know its own rules anymore.
The scheduling tool company took a narrower approach. Any AI-generated interface code had to import from the same component library as hand-written code, and had to pass through the same design review checklist before merge, no exception for "it was just a prototype." It shipped slower. It also shipped a product where a user could not tell which screens were AI-assisted and which were not, because they all followed the same rules. The AI tooling was comparable in both cases. The review gate was the entire difference in outcome.
This is Aero's own practical lens for catching this before it reaches a customer, not an established industry framework. Five questions worth asking about any AI-generated code heading toward production:
A team answering "no" or "not sure" to two or more of these has a code review process built for security, not for product quality, and AI-generated code is exactly where that gap gets exposed.
This problem compounds with two things Aero has written about before. A design system that is not built to be legible to a coding agent in the first place makes it much harder for AI-generated code to inherit the right components automatically, the gap covered in is your design system agent ready. And knowing whether an AI coding tool is operating at the prompt level, the context level, or inside a fuller agentic harness changes what kind of review it actually needs, a distinction laid out in the AI engineering vocabulary stack. Neither replaces a human review gate. Both make it easier to build one that actually catches what matters.
No. The tools are not the risk. Treating AI-generated code as exempt from the review process that applies to everything else is the risk.
No. The consequences differ by industry, a compliance issue in fintech versus a brand consistency issue in media, but the underlying gap, AI-generated code skipping product and design review, shows up everywhere Aero works.
Both. Security and functional review can stay with engineering. Whether the result matches the product's design system, accessibility bar, and interaction patterns needs a design or product reviewer in the loop, not just a linter.
Wondering whether AI-generated code is already shipping past your design and product review without you knowing it? Talk to Aero.
AI coding assistants are shipping features straight to production, but security review isn't catching design, accessibility, or brand drift. Here's Aero's framework for closing that gap before customers do.
Every product now has an AI feature, so having one has stopped being the pitch. Here's Aero's framework for finding real differentiation in the experience around the AI, not the AI itself.
AI platforms are starting to assemble interfaces on the fly instead of shipping fixed screens. Here's what generative UI actually means for product teams, and Aero's framework for using it without losing brand and accessibility control.
