AI Coding Agents Expand Software Supply Chain Risks

• •Only 20% of AI-recommended dependencies are safe, increasing supply chain risks.
• •In 2025, over 454,600 new malicious packages were reported, a 75% increase.
• •Organizations must treat AI-generated code as untrusted and enforce strict security controls.

AI coding agents are introducing significant vulnerabilities into the software supply chain by selecting insecure dependencies without human oversight. Research indicates that only 20% of dependency versions recommended by these agents are safe, leading to a surge in malicious packages. In 2025, over 454,600 new malicious packages were reported, marking a 75% increase from the previous year. The Verizon 2026 DBIR revealed that third-party involvement in breaches rose to 48%, up from 30% in 2025. Organizations are advised to treat AI-generated code as untrusted and enforce rigorous security controls. The shift in dependency governance necessitates new security measures that account for AI's role in software development. As AI assets become critical, traditional security practices may not suffice to manage the evolving threat landscape.