Loading story…
The rapid adoption of AI coding assistants and agentic AI agents in enterprise environments has introduced significant new security risks and operational challenges. AI coding tools, often referred to in the context of 'Vibe Coding,' are increasingly leading software development efforts with minimal human oversight, which has resulted in a notable increase in insecure code being produced. Research such as BaxBench has demonstrated that state-of-the-art large language models (LLMs) generate code with security vulnerabilities in 62% of cases, and even when code is functional, about half of it remains insecure. This trend is exacerbated by the fact that AI models are typically trained on open-source datasets, which themselves are rife with vulnerabilities—studies indicate that 86% of codebases contain at least one vulnerability, and 81% have high or critical-level issues. The over-reliance on AI-generated code is also leading to a skills gap among junior developers, who may lack a deep understanding of the code they deploy. Attackers are exploiting these trends by creating malicious packages that mimic those hallucinated by LLMs, further increasing the risk of supply chain attacks. In parallel, the proliferation of agentic AI and nonhuman identities (NHIs) such as API keys, service accounts, and autonomous AI agents has expanded the enterprise attack surface. These NHIs often have highly sensitive access and are difficult to monitor, leading to the emergence of 'shadow AI'—unsanctioned or unmonitored AI agents that can create blind spots for security teams. Security startups like Entro Security are responding by developing platforms to discover, monitor, and manage AI agents and NHIs, aiming to close these security gaps. The challenge is compounded by the rapid expansion of AI agents, which can result in unowned or overprivileged entities with shadow access to sensitive data. The security industry is at an inflection point, with the influx of AI and LLMs prompting a reevaluation of traditional security practices and the need for more robust controls around AI-generated code and autonomous agents. The convergence of these trends highlights the urgent need for enterprises to implement comprehensive monitoring, validation, and governance mechanisms for both AI-generated code and AI-driven digital identities. Without such measures, organizations risk increased exposure to vulnerabilities, supply chain attacks, and unauthorized data access. The evolving landscape underscores the importance of balancing the productivity gains from AI with the imperative to maintain rigorous security standards and oversight. As AI continues to reshape software development and enterprise operations, security teams must adapt their strategies to address these emerging threats. The industry is witnessing a shift from under-resourced security to an environment saturated with point solutions, yet the core challenge remains: ensuring that the adoption of AI does not outpace the ability to secure it effectively. The future of cybersecurity will depend on the ability to integrate AI safely while maintaining visibility and control over both human and nonhuman digital actors.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The rapid integration of agentic AI systems and AI-generated code into enterprise environments is fundamentally transforming business operations, productivity, and the cybersecurity landscape. AI agents are now embedded in daily workflows, automating tasks and augmenting human capabilities, but their lack of human intuition and ethical judgment introduces new attack surfaces and vulnerabilities. Security experts warn that the rush to deploy agentic AI—autonomous systems capable of executing complex, multistep tasks—without adequate governance or oversight is creating significant risks, including the "confused deputy" problem, where AI agents can be manipulated to misuse their privileges. The proliferation of AI-generated code further compounds these risks, as studies show a high prevalence of design flaws and security vulnerabilities in code produced by large language models, leading to increased technical debt and instability in software delivery. Organizations face mounting challenges in managing accountability and liability as AI systems act with greater autonomy. The lack of robust AI governance policies leaves enterprises exposed to breaches and regulatory risks, with a majority of organizations unprepared to manage the proliferation of "shadow AI." The surge in AI-driven web traffic is disrupting traditional business models in publishing and ecommerce, while adversaries exploit the gap between human and machine decision-making. Security leaders emphasize the need for human oversight, strong identity governance, and comprehensive risk management strategies to address the dual-front of human-AI business risk and to ensure that AI adoption does not outpace the organization’s ability to secure and govern these powerful new tools.
Jul 12, 2026
The rapid adoption of AI coding assistants is fundamentally transforming software development practices across the technology industry. Major companies such as Coinbase, Accenture, Box, Duolingo, Meta, and Shopify have begun mandating the use of AI coding assistants for their engineering teams, with some executives even taking drastic measures such as terminating employees who resist upskilling in AI. This widespread shift is driven by the significant productivity gains that AI coding assistants offer, enabling developers to accelerate deployment and experiment with new approaches. However, the integration of these tools introduces substantial new security challenges, particularly in the context of software supply chain security. Security researchers warn that AI-generated code often relies on existing libraries and codebases, which may contain old, vulnerable, or low-quality software. As a result, vulnerabilities that have previously existed can be reintroduced into new projects, and new security issues may also arise due to the lack of context-specific considerations in AI-generated code. The phenomenon known as "vibe coding"—where developers quickly adapt AI-generated code without fully understanding its implications—further exacerbates these risks. AI models trained on insecure or outdated data can perpetuate flaws, making it difficult for human reviewers to catch every potential vulnerability. The attack surface for organizations expands significantly as AI coding assistants become integral to the development lifecycle, potentially increasing risk by an order of magnitude. Security practitioners emphasize the need for new secure coding strategies tailored to the era of AI-assisted development. Effective communication between security teams and developers is critical to ensure that AI tools are adopted safely and that their benefits do not come at the expense of security. Organizations must rethink their development lifecycles, incorporating rigorous review processes and updated security protocols to address the unique challenges posed by AI-generated code. The transition to AI-driven development is inevitable, but it requires a proactive approach to risk management. Security teams must lead the way in establishing best practices, fostering collaboration, and ensuring that the adoption of AI coding assistants enhances rather than undermines organizational security. The industry is at a pivotal moment where the balance between productivity and security must be carefully managed. As AI coding assistants become non-negotiable tools for developers, the responsibility falls on both security professionals and engineers to adapt and safeguard the software supply chain. The future of secure software development will depend on how effectively organizations can integrate AI tools while mitigating the associated risks.
Jun 29, 2026
Organizations are rapidly integrating AI into software development pipelines, with AI-generated code now present in every surveyed environment and a significant portion of codebases produced by AI tools. Security leaders report increased risk due to limited visibility into where and how AI is used, the proliferation of shadow AI, and the introduction of logic flaws or insecure patterns by autonomous agents. The lack of oversight and formal controls over AI-generated code and tools has expanded the attack surface, making product security and supply chain integrity top priorities for 2026. Industry experts emphasize the need for responsible adoption of AI-driven security tools, highlighting the importance of evaluation, deployment, and governance to maintain control and transparency. New frameworks, such as the AI Vulnerability Scoring System (AIVSS), are being developed to address the unique, non-deterministic risks posed by agentic and autonomous AI systems, which traditional models like CVSS cannot adequately capture. The shift to runtime application security and the management of non-human identities further underscore the evolving landscape, as organizations seek to balance innovation with robust security practices.
Jul 2, 2026