Loading story…
The integration of artificial intelligence into IT operations and software development is transforming how organizations build, deploy, and manage technology. AI-powered self-service IT enables employees, even those without deep technical expertise, to perform complex tasks such as application development and deployment, increasing efficiency and productivity across businesses. This democratization of technology, facilitated by generative and agentic AI, allows for rapid scaling of IT solutions and empowers non-technical users to contribute directly to business innovation. However, this shift introduces significant security and compliance risks, as employees may inadvertently create vulnerabilities or misconfigure systems without fully understanding the implications of their actions. The rise of low-code and no-code platforms, now enhanced by AI, further accelerates this trend, making it easier for organizations to adopt self-service workflows but also increasing the attack surface. Research from Apiiro highlights a concerning trade-off: while AI coding assistants reduce simple coding errors and speed up development, they also lead to a dramatic increase in complex, high-impact vulnerabilities that are difficult for automated tools to detect. These vulnerabilities often reside in business logic or require chained exploits, posing a substantial risk to the software supply chain. Security leaders are increasingly worried about the risks introduced by third-party software, and the widespread adoption of AI-generated code compounds this concern by introducing new, less understood classes of vulnerabilities. The rapid pace of AI-driven development can outstrip traditional security review processes, making it essential for organizations to implement robust guardrails and human oversight. Automated security tools alone are insufficient to identify and remediate the nuanced flaws introduced by AI-generated code, necessitating a combination of AI and human-led security practices. Companies must balance the benefits of increased velocity and efficiency with the imperative to mitigate security and compliance risks. This requires a strategic approach to risk management, including continuous monitoring, education, and the development of new security frameworks tailored to the unique challenges of AI-powered environments. The evolution of self-service IT and AI-assisted development is reshaping the digital supply chain, demanding heightened vigilance and proactive measures from CISOs and IT leaders. As organizations continue to embrace AI, the need for comprehensive security strategies that address both technical and human factors becomes increasingly urgent. Failure to adapt to these new realities could result in significant business harm, including data breaches and regulatory penalties. Ultimately, the era of AI-powered IT calls for a reimagining of security practices to ensure that innovation does not come at the expense of safety and trust.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The rapid adoption of AI coding assistants is fundamentally transforming software development practices across the technology industry. Major companies such as Coinbase, Accenture, Box, Duolingo, Meta, and Shopify have begun mandating the use of AI coding assistants for their engineering teams, with some executives even taking drastic measures such as terminating employees who resist upskilling in AI. This widespread shift is driven by the significant productivity gains that AI coding assistants offer, enabling developers to accelerate deployment and experiment with new approaches. However, the integration of these tools introduces substantial new security challenges, particularly in the context of software supply chain security. Security researchers warn that AI-generated code often relies on existing libraries and codebases, which may contain old, vulnerable, or low-quality software. As a result, vulnerabilities that have previously existed can be reintroduced into new projects, and new security issues may also arise due to the lack of context-specific considerations in AI-generated code. The phenomenon known as "vibe coding"—where developers quickly adapt AI-generated code without fully understanding its implications—further exacerbates these risks. AI models trained on insecure or outdated data can perpetuate flaws, making it difficult for human reviewers to catch every potential vulnerability. The attack surface for organizations expands significantly as AI coding assistants become integral to the development lifecycle, potentially increasing risk by an order of magnitude. Security practitioners emphasize the need for new secure coding strategies tailored to the era of AI-assisted development. Effective communication between security teams and developers is critical to ensure that AI tools are adopted safely and that their benefits do not come at the expense of security. Organizations must rethink their development lifecycles, incorporating rigorous review processes and updated security protocols to address the unique challenges posed by AI-generated code. The transition to AI-driven development is inevitable, but it requires a proactive approach to risk management. Security teams must lead the way in establishing best practices, fostering collaboration, and ensuring that the adoption of AI coding assistants enhances rather than undermines organizational security. The industry is at a pivotal moment where the balance between productivity and security must be carefully managed. As AI coding assistants become non-negotiable tools for developers, the responsibility falls on both security professionals and engineers to adapt and safeguard the software supply chain. The future of secure software development will depend on how effectively organizations can integrate AI tools while mitigating the associated risks.
Jun 29, 2026
Organizations are rapidly integrating AI into software development pipelines, with AI-generated code now present in every surveyed environment and a significant portion of codebases produced by AI tools. Security leaders report increased risk due to limited visibility into where and how AI is used, the proliferation of shadow AI, and the introduction of logic flaws or insecure patterns by autonomous agents. The lack of oversight and formal controls over AI-generated code and tools has expanded the attack surface, making product security and supply chain integrity top priorities for 2026. Industry experts emphasize the need for responsible adoption of AI-driven security tools, highlighting the importance of evaluation, deployment, and governance to maintain control and transparency. New frameworks, such as the AI Vulnerability Scoring System (AIVSS), are being developed to address the unique, non-deterministic risks posed by agentic and autonomous AI systems, which traditional models like CVSS cannot adequately capture. The shift to runtime application security and the management of non-human identities further underscore the evolving landscape, as organizations seek to balance innovation with robust security practices.
Jul 2, 2026
The rapid adoption of AI coding assistants and agentic AI agents in enterprise environments has introduced significant new security risks and operational challenges. AI coding tools, often referred to in the context of 'Vibe Coding,' are increasingly leading software development efforts with minimal human oversight, which has resulted in a notable increase in insecure code being produced. Research such as BaxBench has demonstrated that state-of-the-art large language models (LLMs) generate code with security vulnerabilities in 62% of cases, and even when code is functional, about half of it remains insecure. This trend is exacerbated by the fact that AI models are typically trained on open-source datasets, which themselves are rife with vulnerabilities—studies indicate that 86% of codebases contain at least one vulnerability, and 81% have high or critical-level issues. The over-reliance on AI-generated code is also leading to a skills gap among junior developers, who may lack a deep understanding of the code they deploy. Attackers are exploiting these trends by creating malicious packages that mimic those hallucinated by LLMs, further increasing the risk of supply chain attacks. In parallel, the proliferation of agentic AI and nonhuman identities (NHIs) such as API keys, service accounts, and autonomous AI agents has expanded the enterprise attack surface. These NHIs often have highly sensitive access and are difficult to monitor, leading to the emergence of 'shadow AI'—unsanctioned or unmonitored AI agents that can create blind spots for security teams. Security startups like Entro Security are responding by developing platforms to discover, monitor, and manage AI agents and NHIs, aiming to close these security gaps. The challenge is compounded by the rapid expansion of AI agents, which can result in unowned or overprivileged entities with shadow access to sensitive data. The security industry is at an inflection point, with the influx of AI and LLMs prompting a reevaluation of traditional security practices and the need for more robust controls around AI-generated code and autonomous agents. The convergence of these trends highlights the urgent need for enterprises to implement comprehensive monitoring, validation, and governance mechanisms for both AI-generated code and AI-driven digital identities. Without such measures, organizations risk increased exposure to vulnerabilities, supply chain attacks, and unauthorized data access. The evolving landscape underscores the importance of balancing the productivity gains from AI with the imperative to maintain rigorous security standards and oversight. As AI continues to reshape software development and enterprise operations, security teams must adapt their strategies to address these emerging threats. The industry is witnessing a shift from under-resourced security to an environment saturated with point solutions, yet the core challenge remains: ensuring that the adoption of AI does not outpace the ability to secure it effectively. The future of cybersecurity will depend on the ability to integrate AI safely while maintaining visibility and control over both human and nonhuman digital actors.
Jun 29, 2026