Speed vs. Risk: Experts Weigh In on Using AI Coding Assistants

Artificial intelligence (AI) coding assistants have revolutionized software development, promising speed and efficiency gains. However, experts warn that these tools can introduce security flaws and architectural drift if not used carefully. As the use of AI coding assistants transitions from novelty plugins to integrated engineering tools, developers are grappling with the risks and benefits of relying on them.

The rules of engagement for AI coding assistants vary depending on project complexity and security requirements. Justin Handley, Director of Technology at Monroe Institute, notes that while AI can be helpful in complex tasks, it's not suitable for projects where IP is highly valuable or sensitive information needs to be protected. 'If your code is not your real moat and you're just generally writing normal web app kind of code and you don't care if AI knows about it, then I don't see other security requirements as an issue,' Handley says.

A key challenge in using AI coding assistants lies in their reliability on different types of projects. Sylvain Kalache, Head of AI Labs at Rootly, suggests that these tools may perform better on legacy codebases than greenfield ones due to the accumulated context and documentation available for legacy systems. 'Legacy systems tend to come with years of accumulated context: documentation, runbooks, postmortems, internal wikis describing how the code actually behaves in production,' Kalache explains.

The use of AI coding assistants also raises questions about the role of seniority in development teams. Handley emphasizes that agents do not push back on bad direction and can produce different outputs depending on the experience level of developers using them. 'For a young developer, I mean vibe coding is a bad idea,' Handley warns. 'People who don't know code and are vibe coding, you can get some things done... but for production code that is going to be used by hundreds or thousands of people in real life, vibe coding is almost never going to cut it.'