AI-assisted development is changing how software gets built. What began as a productivity boost is quickly becoming something bigger.

Development is shifting toward greater autonomy. Coding assistants and agents now influence not only how code is written, but also which dependencies are selected, how applications are assembled, and how quickly software moves from idea to production.

That acceleration is real. So is the risk.

Our latest State of the Software Supply Chain research shows that AI does not reduce reliance on open source, but increases it. As teams generate more code, they also consume more components, packages, and transitive dependencies. The result is a larger, more complex software supply chain to manage and secure.

The question is no longer whether to adopt AI, but how to do so safely without sacrificing speed.

AI Is Accelerating Software Consumption, Not Replacing It

A common assumption about generative AI is that it will reduce reliance on open source. In reality, the opposite is happening. As AI-assisted development becomes more widespread, it is driving a sharp increase in open source consumption, not replacing it.

Open source already comprises most modern applications. As AI increases development speed, it also expands the volume of external packages entering enterprise environments. This expansion of the attack surface makes software supply chain integrity more critical than ever.

The Hidden Problem: AI Can Speed Up Coding While Making Dependency Decisions Worse

AI delivers immediate gains. Code is generated faster, prototypes come together quickly, and developers move through repetitive work with less friction.

But problems show up in dependency selection. Models produce working code but often make poor choices about what that code depends on by:

• Recommending outdated or insecure package versions.

• Selecting incorrect or incompatible dependencies.

• Hallucinating packages that do not exist.

• Iterating repeatedly until something "works," rather than what is correct.

This creates a misleading sense of productivity, while builds break and dependencies shift. The result is brittle code, unstable pipelines, and technical debt that teams must fix later.

Why Model Lag Matters More Than Most Teams Realize

This gap isn't accidental but architectural. Foundation models are trained on snapshots of public data, which means they have knowledge cutoffs. Even the latest models can lag real-world changes by months, while older or lower-cost models fall even further behind.

Without proper context, AI is making software supply chain decisions based on stale information. That shows up in several ways:

• Recommending deprecated versions.

• Missing newly disclosed vulnerabilities.

• Favoring historically popular packages over better current options.

• Suggesting nonexistent or malicious dependencies.

Context and better tooling can help, but they don't remove the limitation. Models are still bound by what they know and when they were trained. That's why dependency governance needs to be built directly into AI-driven development workflows.

Autonomous Development Changes the Risk Model

As development shifts from AI assistance to autonomy, the risk profile changes.

Recommending code is one thing. Taking action is another. When agents install packages, update dependencies, modify tests, or interact with build and deployment systems, they move from suggestion to execution. That raises the stakes.

With broad permissions and direct access to external sources, bad decisions have a real impact. A hallucinated package can become a malicious install. An outdated dependency can introduce security or compliance risk. What was once a minor error can now affect entire workflows.

At the same time, attackers are adapting. Malicious packages are being published to exploit predictable AI behavior, including hallucinated names and automated installs. This creates a new entry point into development environments.

Treat AI Agents Like New Hires

A simple rule from the session: treat AI agents like new hires.

You wouldn't give a new developer unrestricted access to every system on day one. The same principle applies to AI. Agents should be controlled, scoped, and governed from the start.

That means enforcing core guardrails:

• Least-privilege access across systems and data.

• Scoped permissions and clear isolation boundaries.

• Restricted network and environment access.

• Full visibility into agent actions and decisions.

In practice, this also means routing all changes through systems of record — source control, artifact repositories, and policy-driven CI/CD workflows — where actions can be reviewed and enforced.

This matters because agents operate at machine speed. A small permission gap or misconfiguration can quickly scale into a much larger issue.

Dependency Governance Has to Move Earlier in the Workflow

If AI influences dependency choices, governance must happen earlier — at the point of selection. After-the-fact scanning is not enough. Organizations need systems that shape decisions before risky packages are introduced.

Instead of exposing models to the full public ecosystem, teams should guide them with curated, enterprise-ready inputs:

• Approved registries and internal artifact repositories.

• Version and upgrade policies.

• Real-time vulnerability and quality signals.

• Organizational standards.

This is where policy-driven dependency governance becomes critical.

When AI operates within these guardrails, outcomes improve. Developers spend less time fixing bad recommendations, builds become more stable, and reviews are more predictable. Security also improves, as models are steered toward current, compliant packages instead of defaulting to outdated or risky choices.

Safe AI adoption isn't just about better prompts. It requires built-in guardrails.

Secure Acceleration, Not Slower Innovation

Safe AI adoption isn't about hindering progress but moving forward with purpose.

That means acknowledging model limits and embedding governance directly into workflows through curated context, controlled dependency selection, least-privilege access, and strong visibility. Success depends on aligning development and security teams around a shared approach.

The organizations that win won't avoid AI. They'll operationalize it with discipline. Autonomous development is here. The question is whether your software supply chain is ready.

To see what you can do now to reduce risk without slowing innovation, watch our webinar and explore our research and recommendations on autonomous development.