AI coding assistants can generate functional software in seconds, but what happens to security when developers repeatedly ask AI to modify, debug, extend, and simplify the same application?

This session explores **security drift**: the gradual introduction, reintroduction, or amplification of vulnerabilities as AI-generated software evolves through iterative prompting. Instead of evaluating AI-generated code from a single prompt, we examine what happens across multiple development cycles. An application may begin relatively secure, but seemingly harmless requests such as “add authentication,” “fix this error,” “make deployment easier,” or “simplify this function” can weaken security controls established in earlier versions.

Through practical examples and experimental results, attendees will see how vulnerabilities involving authentication, input validation, injection, secrets, insecure configurations, and weakened security controls can emerge and evolve across successive AI-generated revisions.

The session will demonstrate methods for measuring and detecting security drift using automated security analysis and security-aware code comparison. Attendees will leave with a practical approach for incorporating AI coding assistants into development workflows without assuming that code that was secure yesterday will remain secure after the next prompt.