When GenAI and low-code collide: What could go wrong for AppSec?

This report analyzes how the combination of low-code/no-code development and generative AI accelerates delivery while amplifying security risks, including over-permissioned integrations, opaque AI-generated code, API-driven attack surface expansion, hallucinated package dependencies enabling supply-chain poisoning, and prompt-injection–enabled privilege escalation. Citing expert insights and recent guidance, it urges teams to move beyond traditional AST toward comprehensive software supply chain security—rigorous API and component reviews (including hallucinated calls), binary analysis, reproducible builds, stronger governance of low-code environments, and dedicated roles to manage the expanded risk.