AI code is twice as likely to have bugs. Qoder fixes that during the session

AI writes code faster than any human team can review it. That speed has a cost: over 40% of new code is now AI-generated, and a July 2026 study of nearly 9,000 C++ programs found that AI code triggers runtime violations at roughly twice the rate of human-written code, even when controlling for length and test pass rates. Traditional security scanning, isolated in CI pipelines, catches problems only at the last moment before deployment, by which time the developer's context is gone and false positives require line-by-line manual verification. This problem has been well documented, as a deep dive into AI-generated code risks shows.

The Security Paradox of AI-Generated Code

The volume of code changes has grown exponentially, but enterprise security review capabilities haven't kept pace. Traditional tools face three pain points: high false-positive rates that drown developers in noise, poor interpretability of results, and intervention that comes too late, after code is written, context is lost, and vulnerabilities sometimes land in production. When OpenAI's Codex Security launched earlier this year, it chose repository-level scanning. Anthropic integrated security review into Claude Code's coding sessions, a move that aligns with the broader trend toward orchestrated agentic workflows. The consensus is that security checks must happen at the exact moment code is born, not afterward.

Qoder Security: Embedding Protection into the Coding Session

Qoder, Alibaba's agentic AI coding platform, is now the first mainstream product in China to offer integrated, proactive security of this kind. Qoder Security is built into Qoder Desktop and Qoder CLI, activated by a single toggle in settings. It essentially assigns a dedicated security engineer to review, verify, and fix issues in stages alongside every developer.

Inside the Three Layers: From Real-Time Regex to Cross-File Deep Analysis

Running the most powerful large model on every line of code would be too slow and too expensive. Qoder Security solves that with a three-tier design, each layer handling its specific responsibility without interrupting the developer's flow.

Layer 1: Real-time Regex Interception. Operates at the character stream level as code is generated. Dangerous function calls are detected and auto-fixed instantly with zero latency and no extra compute cost. It is the first line of defense, always on.

Layer 2: Semantic Incremental Review. After a task completes, the system suggests a scan. It reviews only the incremental code from the current change, but looks both at the code and its underlying intent. Risks requiring semantic understanding, SQL injection, remote code execution (RCE), sensitive information leaks, are caught here.

Layer 3: Cross-file Deep Review. Before submission, the system asks whether to run a deeper scan. It tracks complete data flows across files and functions, from taint source to dangerous sink, uncovering hidden correlated vulnerabilities impossible to see from a single file. In one internal example, the system traced HTTP query parameters through a Service layer and across three files to pinpoint a deserialization call with autoType enabled and no whitelist, an RCE chain that no single-file scan could detect. This approach mirrors how specialized detection agents can surface vulnerabilities that general-purpose models miss.

All three layers run without blocking the developer. The first layer runs automatically; the other two prompt the user to initiate a scan at appropriate times, running only upon explicit approval.

Proven Impact: Numbers from Internal Testing

Before the official launch, Qoder tested the system on production-grade open-source projects and AI infrastructure components. Despite well-maintained codebases, the scans uncovered over 600 security issues. Among them was a critical remote code execution vulnerability in Fastjson, a widely used JSON library. Qoder Security now detects that specific vulnerability automatically when Fastjson is used to parse external input during AI-assisted coding.

The performance metrics are notable. Compared to traditional approaches, Qoder Security improves vulnerability detection rates by roughly 60%. False-positive alerts drop by approximately 80%. Time to identify and remediate a single vulnerability shrinks from days or weeks to hours. Within Alibaba's own engineering teams, adopting Qoder Security reduced security-related feedback in code reviews by 35% to 45%, because risks are caught and resolved during coding rather than at review time. The market response to integrated coding tools suggests developers value this kind of workflow efficiency, as OpenCode's rapid growth demonstrates.

None of this means manual review is obsolete. Qoder Security is designed to complement CI and manual processes: it shifts security left to the coding phase, while compliance logging and governance remain separate responsibilities. The system may still produce false positives, and the developer always retains the final say on whether to accept a suggested fix.

The Industry Shift Toward In-Session Security

OpenAI's Codex Security and Anthropic's Claude Security both made moves earlier this year. Codex Security opts for repository-level scanning; Anthropic integrated security review directly into Claude Code sessions. Qoder's approach is to embed security protection directly within the agent's coding session, powered by a proprietary security large model that understands code context and taint propagation paths. Instead of static rule matching, it self-verifies the reachability of detected issues, reporting only genuinely reachable risks. The security review agent operates independently from the coding agent, avoiding the trap of self-verification. A scanning sub-agent and a verification sub-agent work together to improve detection accuracy. This design contrasts with the deliberate security blind spots some frontier models carry.

AI makes coding faster, as the source puts it, but producing vulnerabilities faster is not the answer. For sustainable, scalable agentic coding, security must be the default setting from the very first line of code.