ActiveState study finds AI code outpaces security review

Research from the Linux Foundation shows a widening gap between the pace of AI-driven software development and organizations' ability to secure the code being produced. The study was sponsored by ActiveState and supported by the Open Source Security Foundation and LF AI & Data.

Survey results indicate that 58% of teams ship code faster than security reviews can keep up. Sixty percent say AI coding assistants have increased the number of external packages in their codebases, yet teams review the transitive dependencies those packages introduce only about half the time. The pressure is growing as AI speeds both code generation and vulnerability discovery, leaving less time to fix flaws before attackers exploit them.

The survey drew on 172 security practitioners at companies and open source projects. Respondents credited AI-assisted tools with detecting 30% of the vulnerabilities they found in the past year, and 69% said the tools meaningfully improved their security posture. On average, security work ran 17% faster with AI tools, but false-positive vulnerability reports increased practitioners' workloads by 30%.

Other findings show that 82% of respondents agree overreliance on AI tools weakens developers' security skills, and only 30% of teams have a dedicated role for AI-related threats. The report recommends assigning a clear owner for those threats, formalizing AI security policies that include human review of generated code, and strengthening controls on direct and transitive dependencies.

ActiveState recommends governing open source at the point of intake, alongside scanning and review. “AI coding assistants don't just write code. They choose your dependencies, and this research shows teams are checking only about half of what comes along for the ride,” said Abby Kearns, CEO of ActiveState.

“As AI accelerates software development, organizations need to be just as deliberate about how they govern and secure the code being produced,” said Laura Guazzelli, Security Architect for AI/ML/LLM/Agentic Systems at OpenSSF. “That starts with understanding where AI is introducing risk into the software supply chain, establishing clear ownership for addressing it, and ensuring security practices can keep pace with how software is built.”