What Changes When Your Software Supply Chain Includes AI Writing Your Code?

The inclusion of AI in the software build pipeline has added a new layer of complexity to software supply chain security. Previously, the primary concern was identifying the components and dependencies within the code. The focus was on determining which open-source packages and versions were being used, as well as uncovering unintended transitive dependencies. Notable incidents such as SolarWinds, Log4Shell, and XZ Utils have highlighted the risks associated with code components. The addition of AI-generated code introduces new challenges to this already difficult task. The risk is no longer solely in the code itself, but also in the potential vulnerabilities introduced by AI-generated components.