Executive Overview
The board-safe position on AI coding tools is neither enthusiasm nor resistance. It is capacity accounting.
AI-assisted development can make developers faster and more confident, especially in early coding tasks. But that does not prove the software delivery system has become faster, safer, or cheaper. What breaks first is usually not coding speed. It is the control layer: the ability to review, validate, remediate, and assure production quality.
The open-source curl example is a useful warning, not because it proves enterprise outcomes, but because it makes the operating dynamic visible. The reported problem shifted from obvious AI-generated security noise to more plausible AI-assisted findings that took real maintainer effort to evaluate.1 OpenSSF has described the broader pattern: AI is increasing the speed and scale of vulnerability discovery, while maintainers face an unprecedented influx of findings without matching triage and remediation capacity.2
For CIOs, the …