Study reveals 58% of teams ship code faster than security review can keep up, as AI coding tools add dependencies that teams vet only about half the time

VANCOUVER, BC, Nov. 9, 2026 /PRNewswire/ — ActiveState, a sponsor and contributor to a new Linux Foundation research study supported by the Open Source Security Foundation (OpenSSF) and LF AI & Data Foundation, today announced findings from the State of AI Impact on Software Security and Cybersecurity 2026, revealing a growing gap between the pace of AI-driven software development and organizations’ ability to secure the code being produced. The study found that 58% of surveyed teams ship code faster than security reviews can keep up, while 60% say AI coding assistants have increased the number of external packages in their codebases. Yet teams review the indirect, or “transitive,” dependencies introduced by those packages only about half the time.

These challenges are becoming more urgent as AI accelerates both code generation and vulnerability discovery, leaving organizations less time to identify and remediate security flaws before attackers exploit them. The October 2026 PHP2Shell vulnerabilities underscored the urgency, with emergency patches issued and exploitation attempts reported within hours of disclosure. As vulnerabilities can be identified and exploited at increasing speed, organizations face mounting pressure to ensure security reviews, dependency vetting, and remediation keep pace.

The survey of 172 security practitioners across companies and open source projects also found that AI is part of the solution, albeit with some trade-offs. Respondents credited AI-assisted tools with detecting 30% of the vulnerabilities they found in the past year, and 69% said the tools had meaningfully improved their security posture. On average, AI tools made security work 17% faster, but false-positive vulnerability reports increased practitioners’ workloads by 30%, highlighting the need to balance AI-driven efficiency with effective security oversight.

“AI coding assistants don’t just write code. They choose your dependencies, and this research shows teams are checking only about half of what comes along for the ride,” said Abby Kearns, CEO of ActiveState. “That matches what we hear from customers every week. Slowing developers down won’t fix it. The answer is to decide what’s trusted before it reaches the codebase, so developers and their AI tools start from components security has already approved.”

Other key findings:

• Skills are at risk. 82% of respondents agree that overreliance on AI tools weakens developers’ security skills.
• Concern outpaces readiness. For every AI-related threat measured, more practitioners are concerned than feel prepared. The widest gap, 41 points, is for AI-automated exploit generation and fuzzing.
• The supply chain tops the worry list. Supply chain attacks are the leading concern among security experts (93%), followed by prompt injection (90%) and the maintenance burden of high component-update volume (87%).
• Nobody owns it. Only 30% of teams have a dedicated role responsible for AI-related security threats, and only about one in three have a formal security policy that addresses AI.
• Ownership pays off. 75% of teams with a dedicated AI security role say they are well prepared for adversarial attacks on AI systems, compared with 50% of all respondents.
• Human review isn’t a given. Among teams with an AI security policy, only 57% require human review of AI-generated code.

Together, the findings point to a need to make security responsibilities explicit and strengthen governance as AI adoption grows. Dedicated roles, clear policies, and properly implemented tools correlate with greater preparedness; the survey does not establish that those practices cause the difference.

“As AI accelerates software development, organizations need to be just as deliberate about how they govern and secure the code being produced,” said Laura Guazzelli, Security Architect for AI/ML/LLM/Agentic Systems at OpenSSF. “That starts with understanding where AI is introducing risk into the software supply chain, establishing clear ownership for addressing it, and ensuring security practices can keep pace with how software is built.”

The report recommends that organizations assign a clear owner for AI-related security threats, formalize AI security policies that include human review of generated code, and strengthen controls on direct and transitive dependencies. Building on those findings, ActiveState recommends governing open source at the point of intake, alongside scanning and review, so security teams decide which components enter the software supply chain before developers or AI assistants pull them in.

Read State of AI Impact on Software Security and Cybersecurity 2026 for the findings and practical recommendations: https://www.linuxfoundation.org/research/ai-impact-on-cybersecurity-2026

About ActiveState

ActiveState secures the software supply chain at the source for the AI coding era. With the ActiveState Curated Catalog, a private, vetted repository of open source components, security teams decide what gets into enterprise software before developers or AI coding assistants pull it in. Security gets control, and engineering keeps its speed. The Curated Catalog works with the artifact repositories, scanners, and AI coding assistants that teams already use. Learn more at activestate.com.

View original content to download multimedia:https://www.prnewswire.com/news-releases/ai-is-writing-code-faster-than-security-can-review-it-finds-new-linux-foundation-research-sponsored-by-activestate-302931650.html

SOURCE ActiveState