Nearly every engineering team has adopted AI coding assistants. Almost none of them can answer a simple question: which of our AI models, agents, and MCP servers, actually exist, and how much risk is it carrying? That gap has a name now. Gartner formally defined AI Security Posture Management (AI-SPM) in its 2025 Hype Cycle for Data Security, the same lineage that produced CSPM and DSPM. The category exists because the problem is real: AI is no longer just a tool developers use. It is now part of the attack surface.
It’s also the topic we’ll be discussing on the ground at OWASP AppSec Days Portugal 2026, September 23-24 in Porto, where Xygeni is a Gold sponsor. More on that at the end, but if you want to skip ahead, get your ticket here.
The problem: AI-generated code carries its own risk profile
Roughly 40% of AI-generated code contains security vulnerabilities. Independent research on AI coding assistants has found consistently high failure rates against the OWASP Top 10, with certain flaw categories like cross-site scripting showing up in the vast majority of generated samples. AI assistants don’t just write code faster. They reproduce insecure patterns, insecure dependencies, and unsafe configurations faster too, and they do it at a volume no manual review process was built to handle.
The attack surface doesn’t stop at the code an assistant writes. It extends to the AI assets your teams already run and rarely inventory: models, datasets, agents, and MCP servers. Each has already produced real, documented attacks:
- Rules File Backdoor: attackers hide instructions using invisible Unicode characters inside rules and configuration files read by tools like GitHub Copilot and Cursor, causing the assistant to emit backdoored code without ever mentioning it. Catalogued as a MITRE ATLAS case study.
- MCP tool poisoning and remote code execution: a critical vulnerability in a widely used MCP bridge, downloaded more than 437,000 times, allowed full remote code execution the moment a client connected to an untrusted MCP server.
- Slopsquatting: large-scale academic research generated over two million code samples across sixteen LLMs and found that nearly one in five recommended packages didn’t exist at all, names attackers can register and weaponize ahead of time.
None of this shows up in a traditional SAST or SCA scan. Those tools understand code. They don’t understand what a model is, what an MCP server is doing, or whether an agent’s configuration file has been tampered with.
Most teams are solving half the problem
The instinctive response is to bolt on point tools: one for model scanning, another for runtime prompt firewalls, a third for IDE assistants. It’s the same mistake AppSec made with SAST, SCA, and secrets scanning fifteen years ago, and it produces the same outcome: fragmented visibility, alert noise, and no single place to answer “what AI do we actually run, and is it safe.”
Discovery without remediation just tells you where the fire is. Remediation without discovery means you’re fixing code while shadow MCP servers and unapproved agents run unmonitored next to it. AI security has to cover both, on the same platform, or it isn’t posture management. It’s a dashboard.
The better way: AI Security Posture Management that discovers, detects, and fixes
Xygeni AI Security closes this loop across the full AI-era SDLC, from the model and the MCP server to the developer’s endpoint.
- Discover. AI-SPM builds a live inventory of every AI asset in the organization: models, datasets, agents, MCP servers. It proves that inventory with an AI-BOM, the evidence base auditors and regulators are increasingly asking for, whether that’s technical documentation for high-risk systems under the EU AI Act or the asset inventories required by frameworks like Spain’s ENS.
- Detect. AI Security scores each asset against real risk: prompt injection, insecure MCP configurations, data exposure, aligned to the OWASP Top 10 for LLM Applications. Findings are ranked, not dumped into a queue.
- Fix, at the point code is written. This is where AI-generated code security actually gets solved. Xygeni DevAI runs as a continuous layer inside the IDE, scanning incrementally as developers work with human-written and AI-generated code alike. It performs agentic AI vulnerability detection, maps AI-driven attack paths to show how a flaw could actually be exploited, and delivers AI-generated secure fixes that are validated for exploitability and breaking-change risk before a developer ever applies them. Guardrails validate changes against security and compliance policy before they reach CI, and a dedicated DevAI Agent intercepts what other agents are about to do: validating skill and rules files, screening every package an agent tries to install against malware and slopsquatting patterns, and watching MCP tool behavior for poisoning, all before execution.
- Enforce. Shield extends the same policy to the developer’s endpoint, blocking unsafe AI activity before it runs.
And because AI Triage, Explanation, and Remediation apply not just to Xygeni’s own findings but to everything ingested from tools already in place, teams get this without ripping out what they’ve already invested in.
Meet Xygeni at OWASP AppSec Days Portugal 2026
We’re bringing this conversation to Porto. Xygeni is a Gold sponsor at OWASP AppSec Days Portugal 2026, running September 23-24 at the Fundação António Cupertino de Miranda.
We’ll be at the event talking through AI Security Posture Management in practice: how teams are discovering AI assets they didn’t know they had, how AI-generated code security fits into an existing AppSec program instead of sitting next to it, and what the current wave of MCP and agentic threats actually looks like in the wild.
If you’re attending, come find the Xygeni team at booth 12. If AI security posture is on your roadmap and you can’t make it to Porto, we’re happy to walk through it directly. On the same dates, we’re also at German OWASP Day 2026 in Karlsruhe, talking through AI Security and Shield’s enforcement layer specifically.
FAQ
What is AI Security Posture Management (AI-SPM)?
AI-SPM is the discipline of discovering, inventorying, and continuously assessing the risk of every AI asset an organization runs- models, datasets, agents, and MCP servers- the same way CSPM does for cloud and DSPM does for data. Gartner defined it as a category in its 2025 Hype Cycle for Data Security. Xygeni’s AI-SPM builds that inventory and backs it with an AI-BOM, giving security and compliance teams evidence they can hand to an auditor.
What makes AI-generated code security different from traditional SAST or SCA?
Traditional static analysis and dependency scanning were built to understand code and packages, not AI-specific risk. They don’t see prompt injection, malicious rules or skill files, MCP tool poisoning, or slopsquatted package names an AI assistant might install. AI-generated code security has to sit inside the same workflow developers already use, scanning both human-written and AI-generated code together, which is what Xygeni DevAI does inside the IDE.
Why does around 40% of AI-generated code contain vulnerabilities?
AI coding assistants learn from and reproduce the patterns in their training data, insecure ones included, and they generate code far faster than manual review can keep up with. Independent research has consistently found high rates of OWASP Top 10 vulnerabilities in AI-generated samples, with certain flaw categories like cross-site scripting appearing in the large majority of tests.
Does AI-SPM replace our existing AppSec tools?
No, and it shouldn’t try to. Xygeni’s AI Triage, Explanation, and Remediation apply to findings from Xygeni’s own scanners and to findings ingested from third-party tools already in place, so teams get unified AI risk coverage without a rip-and-replace of what they’ve already invested in.
Where can I see this in action?
Xygeni is a Gold sponsor at OWASP AppSec Days Portugal 2026, September 23-24 in Porto, and the team will be on-site at booth 12 talking through AI-SPM, AI-generated code security, and the current wave of MCP and agentic threats. Get your ticket, or reach out directly if you can’t make it to Porto.
The same week, we’re also at German OWASP Day 2026 in Karlsruhe, focused on AI Security and Shield’s enforcement layer.
