AI coding assistants are changing software development from a process of writing code to a continuous conversation: generate an application, add authentication, fix an error, simplify a function, optimize deployment, and repeat. But what happens to security as the same codebase is repeatedly rewritten by AI?

This talk introduces **security drift**: the gradual introduction, reintroduction, or amplification of vulnerabilities across iterative AI-assisted development. Rather than evaluating whether an AI model can generate secure code from a single prompt, this research examines how security changes across multiple revisions of the same application.

Using controlled experiments and automated security analysis, I track vulnerabilities across successive AI-generated code versions and measure when security controls are preserved, weakened, removed, or unintentionally bypassed. The analysis examines issues including authentication, input validation, injection vulnerabilities, secrets exposure, insecure configuration, and security regressions introduced while solving unrelated development tasks.

The talk will demonstrate how seemingly harmless prompts such as “make deployment easier,” “fix this error,” or “simplify the implementation” can alter the security posture of previously generated code. Attendees will see how security drift can be measured, visualized, and detected throughout an AI-assisted development workflow.

The goal is not to argue against AI coding tools, but to show why securing AI-generated software requires continuous security validation rather than a one-time review. Attendees will leave with practical techniques for identifying security drift and integrating security checks into increasingly agentic software development workflows.