AI Code Verification: Defending Against Shadow AI
- Jul 16
- 3 min read
On RBC TV, Loran Jacobs exposed severe application flaws, explaining why rigid AI code verification is vital to neutralize hidden enterprise security risks.
During his recent appearance on the flagship RBC TV program "Hour: What It Means," Loran Jacobs delivered an urgent warning regarding the rapid spread of unregulated automation in modern software engineering pipelines. While generative tools act as an exceptional operational accelerator, using them without proper verification pipelines introduces unprecedented systemic challenges that corporate engineering teams must address.
The Admin Rights Dilemma in AI Code Verification
The core contradiction of modern generative systems lies in balancing rapid deployment with fundamental architecture safety. Artificial intelligence tools significantly increase development speed, but they lack human intuition regarding security boundaries.
"We consider assistants who write code like a junior developer," explains Loran, "and, accordingly, it helps us with speed. This is a mad advantage for both industry and developers. And, on the other hand, the main problem is that this junior is entrusted with rights at the level of an admin."
This unchecked authority creates massive corporate blind spots when automated scripts are rushed directly into production environments without deep procedural analysis.
According to the founder and CEO of iPavlov, the race for rapid deployment causes teams to skip critical evaluation stages. When engineering departments fail to establish clear automated guardrails, they actively invite Shadow AI risks straight into their live infrastructure.
Unmasking Critical Software Vulnerabilities
To ground his analysis in operational reality, the tech entrepreneur pointed to definitive AppSec research illustrating a systemic software crisis. Analysts identified nearly 49,000 distinct software vulnerabilities across popular mobile applications, marking a staggering 63% year-over-year threat surge driven by unchecked coding shortcuts. Even more alarming is the baseline danger: 84% of evaluated programs contained flaws operating at high or critical exposure levels.
These structural defects routinely reveal themselves across three major architectural layers:
Weak Encryption: Workflows defaulting to outdated cryptographic frameworks and fragile encryption keys.
DOCX
Unsafe Network Protocols: Instructions patched together without senior oversight, hardcoding backdoors into corporate networks.
DOCX
Flawed Data Storage: Severe failures in properly isolating local user data profiles and session logs on client devices.
DOCX
"Speed gives a lot of savings," notes Loran, "but the main requirement is, of course, to check the code." Failing to mitigate these hidden cybersecurity risks early leads to severe database leaks and financial losses that quickly eclipse any initial time-to-market advantages.
Ecosystem Risks, Deepfakes, and Neurocryptography
When examining threat surfaces, the prominent figure in the AI ecosystem emphasizes that end users remain the most vulnerable target segment. While large corporations routinely check industrial code multiple times, consumer applications and state service platforms often execute unvetted scripts that can easily contract viruses or compromise private user profiles.
Beyond traditional data leaks, the unique nature of generative systems amplifies ongoing application security threats. Loran stresses that deepfakes and advanced behavioral exploits require entirely new defensive paradigms. To actively combat this, his team established a dedicated laboratory specializing in neurocryptography to shield the wider tech ecosystem.
Can Artificial Intelligence Detect Systemic Flaws?
Addressing whether AI can effectively self-correct and find vulnerabilities within human or machine-generated scripts, the top AI expert confirms its potential. However, this capacity relies entirely on the availability of a comprehensive engineering infrastructure.
"It can, but, you know, there should be a rather large, let's say, database for training such a code," adds Loran. "And, in fact, it may sound ironic, but the more such bad cases there are, the more we can get data and train on them."
Currently, a major ongoing threat involves software automatically storing outdated passwords or tokens, prompting the leading artificial intelligence authority to urge users to execute manual data checks. Ultimately, maintaining continuous, rigid AI code verification pipelines remains the only definitive way to safeguard live production servers from systemic operational failure.
