Loading story…
AI coding tools are accelerating software contribution and vulnerability remediation, but they are also expanding the volume of code that maintainers and enterprise engineering teams must validate. Open-source projects—many operating with limited funding and staff—face added exposure from AI-assisted flaw discovery and exploitation, malicious packages, incomplete software bill of materials adoption, and poor visibility into the dependencies organizations rely on.
Security leaders are being urged to treat AI-generated code as disposable implementation governed by explicit requirements, specifications, and tests rather than trusting it as inherently reviewable. AI-assisted review can help identify defects, including a generated regular expression vulnerable to catastrophic backtracking and application denial of service, but it does not remove the need for governance. Recommended controls include investing in project maintenance, documentation, secure packaging, dependency inventories, fundraising, and requirements-focused review while using automated tools to remediate issues and remove obsolete code.
Track how attackers are adapting to this technology.
6 events from the most recent confirmed update back to the earliest known activity.
Between April and October 2025, Google reported that its CodeMender agent contributed 72 security fixes to open-source projects, including projects containing up to 4.5 million lines of code.
The Linux Foundation reported $292,217,236 in revenue for 2024, while the Apache Software Foundation reported $2,379,402, illustrating uneven funding among open-source institutions.
Arthur Whitney’s 1989 J Incunabulum provided a compact C implementation of an interpreter for the J programming language, later cited by Phillip Mortimer as an example of dense and difficult-to-read software.
Carta’s Feature Flag Reaper Claude skill autonomously removed more than 400 feature flags and tens of thousands of lines of dead code. Carta also implemented a Claude skill using observability data to help remediate software problems, though it was not fully autonomous.
Phillip Mortimer described an AI code review that found catastrophic backtracking in an AI-generated regular expression. The overlapping repeated pattern could cause exponential processing when rejecting inputs and potentially lock an application in a denial-of-service condition.
Six authors writing for the ACM Technology Policy Council said AI coding tools increase the volume of code that human open-source maintainers must review and can aid both vulnerability remediation and attackers. They called for improved funding, governance, documentation, packaging, and dependency management.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Enterprises are accelerating adoption of AI coding assistants and agents, with vendors and engineering leaders reorganizing around tools such as GitHub Copilot, Codex, Claude Code, and formal-verification agents to increase software output and support smaller teams. OpenAI has reportedly shifted strategy toward coding and enterprise customers, while companies such as Cursor are deploying always-on security agents that scan pull requests, patch dependencies, and block risky changes before release. Research and industry reporting also show AI is changing how developers work: Copilot users spend more time coding and less time on collaboration and project-management tasks, and engineering teams increasingly treat AI as a force multiplier rather than a replacement for human developers. At the same time, multiple studies and incident reports say the gains are being offset by a growing **review and supervision tax**. Reports from Harness, DORA, Sonar, and other researchers found that heavier AI use often correlates with more code review effort, higher defect and deployment risk, longer remediation and recovery times, and rising burnout among senior engineers who must validate AI-generated changes. Security researchers at RSAC 2026 said AI assistants reproduce common flaws such as `SSRF`, `XSS`, path traversal, command injection, and open redirects at scale, while reporting tied AI-assisted changes to outages and operational failures, including an AWS disruption. Across the coverage, experts urged organizations to keep humans in the loop, apply stricter governance and testing for AI-generated code, and measure validation workload, defect escape, and technical debt rather than code volume alone.
Jul 1, 2026
The widespread adoption of generative AI (GenAI) tools in software development has significantly increased productivity, enabling developers to document, write, and optimize code at unprecedented speeds. According to a 2023 McKinsey study, organizations have rapidly integrated AI into their development workflows, with 83% using AI for code creation and 57% relying on AI-powered coding tools as a standard practice. However, this surge in AI-assisted coding has introduced new security risks, as traditional security models focused on perimeter or infrastructure controls do not adequately protect the data and code generated by these tools. Studies have revealed that nearly half of code snippets produced by popular AI models contain vulnerabilities, underscoring the prevalence of insecure code generation. High-profile incidents, such as Samsung's 2023 ban on ChatGPT following a sensitive code leak, highlight the real-world consequences of insufficient safeguards when using GenAI in development environments. The responsibility for securing data and code remains with developers, even as cloud providers secure the underlying infrastructure. The rapid pace of AI-generated code has outstripped the ability of traditional secure coding training to keep up, shifting the focus from training human programmers to ensuring that AI systems themselves are capable of secure coding. Industry experts note that AI is currently less effective at producing secure code than human programmers, with multiple studies and reports from sources like Schneier on Security, Veracode, and SC Media confirming this trend. The volume of vulnerabilities continues to rise, with over 47,000 publicly known vulnerabilities expected in a single year and at least 130 new vulnerabilities reported daily. This ongoing wave of vulnerabilities leads to constant exploitation and patching, further emphasizing the need for secure coding practices at the AI level. While AI has delivered substantial productivity gains—developers report 30% to 40% increases—these benefits are undermined by the security shortcomings of AI-generated code. The industry is now at a crossroads, where the imperative is to teach AI systems to code securely, rather than relying solely on human oversight or post-development security reviews. Integrating security into the AI coding process and providing developers with tools that embed data protection are seen as essential steps to address these emerging challenges. The shift towards AI-driven development necessitates a reevaluation of security strategies, focusing on proactive measures that align with the realities of modern software engineering. Without such changes, organizations risk exposing themselves to significant security threats stemming from the very tools designed to enhance their productivity.
Jun 29, 2026
Multiple studies and industry reports found that **AI-generated or "vibe-coded" software is frequently shipped with serious security flaws**, including XSS, SQL injection, hardcoded secrets, unsafe `eval` usage, weak authentication logic, wildcard CORS, exposed `.env` data, and insecure dependencies. One analysis of 5,600 publicly accessible AI-built applications reported more than 2,000 high-risk vulnerabilities and over 400 exposed secrets, while a separate review of 549 self-described AI-generated repositories found widespread committed secrets, injection issues, hardcoded passwords, and other common sanitization failures. Veracode and other researchers similarly warned that code produced by large language models often maps to **OWASP Top 10** weakness classes and that repeated AI-assisted edits, poor prompts, and excessive agent permissions can further increase risk. At the same time, researchers and vendors highlighted both the promise and fragility of AI-assisted security tooling. Trail of Bits reported that OpenAI Codex goal-based prompting helped uncover previously unknown bugs in projects including **Rust**, **curl**, **zlib**, and **Keycloak**, but stressed that human experts were still needed to scope goals, validate findings, and handle disclosure. New academic work also showed that **LLM-based vulnerability detectors can be easily misled**: the ALIBI framework used adversarial code comments to evade four detectors with success rates above 90%. In response to growing concern over agent reliability, Amazon backed the Lean language project to strengthen formal verification for AI agents, while security experts argued that theorem proving can improve assurance for high-risk components but should be applied selectively as part of broader defense-in-depth.
Aug 4, 2026