#Canada #Vancouver #Linux Foundation #OpenSSF #ActiveState

AI-Fueled Coding Is Outpacing Security Reviews

A recent research study titled "State of AI Impact on Software Security and Cybersecurity 2026," sponsored by ActiveState and supported by the Linux Foundation's Open Source Security Foundation (OpenSSF), has unveiled a significant concern in the realm of software development. The study highlights a glaring discrepancy between the speed at which AI-driven software is being created and the security practices in place to assess this code. According to the data, a staggering 58% of development teams reported that they are able to ship code faster than their security reviews can effectively keep up within a timely manner.

Furthermore, 60% of the respondents indicated that the implementation of AI coding assistants has led to an increased number of external packages within their codebases. However, when it comes to thorough reviews, teams only scrutinize the indirect dependencies that these packages introduce about 50% of the time. This raises the stakes as vulnerabilities can be identified and exploited in a matter of hours, leading to situations where developers are left scrambling to patch security gaps after vulnerabilities like those discovered in the October 2026 PHP2Shell incident.

The urgency of these findings is heightened by the rapid advancements in both AI's ability to generate code and the speed at which it can discover potential vulnerabilities. With attackers also leveraging these fast-paced dynamics, organizations face immense pressure to ensure not only that security reviews are effective but also that dependency vetting is conducted comprehensively. The report surveyed 172 security practitioners from various companies and open source projects, emphasizing that while AI tools account for about 30% of the vulnerabilities detected in the past year, they come with increased false-positive vulnerability reports—ultimately raising the workloads of developers by 30%.

Abby Kearns, CEO of ActiveState, commented on the findings, stating, "AI coding assistants don’t just write code; they also select dependencies. What this research shows is that teams aren’t adequately checking these added components. The solution isn’t to slow down developers but rather to ensure that the components integrated into codebases are pre-approved for security."

Some additional critical insights from the study include:

• - Skill Risk: A significant 82% of respondents believe that excessive reliance on AI tools could weaken developers' inherent security skills.
• - Concern vs. Readiness: On a broader scale, the survey illustrates that more practitioners express concern over AI-related threats than those who feel adequately prepared to address them. A predominant gap was observed in dealing with AI-generated exploit generation and fuzzing—marked at 41 points.
• - Supply Chain Threats: Supply chain attacks emerged as the leading issue for security experts, with 93% highlighting this as a primary concern, closely followed by worries regarding prompt injections and the challenge of keeping up with high volumes of component updates.
• - Lack of Ownership: Alarmingly, only 30% of teams assigned a dedicated role to handle AI-related security issues, and merely one in three reported having formal policies that address AI risks.
• - Human Oversight: Among teams that have put AI security policies in place, only 57% necessitate a human review for AI-generated code.

The research underscores the pressing need for organizations to clearly define security responsibilities, enhance governance as they integrate AI tools more widely, and put effective practices into place to protect their software supply chains. According to Laura Guazzelli, a Security Architect at OpenSSF, it is crucial for organizations to recognize where AI introduces risk and to implement the necessary governance structures to manage these threats efficiently.

ActiveState strongly recommends that organizations take action by assigning a clear owner for AI-related security threats, establishing well-defined security policies that necessitate human review of AI-generated code, and implementing tighter controls over both direct and transitive dependencies. Their Curated Catalog is one tool being proposed to help organizations take a proactive stance in which security teams can dictate which components intro into the software supply process before developers or AI coding assistants bring them in.

For insights into these findings and actionable recommendations, read the full report, State of AI Impact on Software Security and Cybersecurity 2026.

In summary, as AI technology continues to evolve and accelerate software development processes, it is increasingly vital for organizations to adjust their security practices accordingly and ensure a balanced approach that upholds both innovation and safety.