Survey: AI Coding Tools Increase Open Source Software Dependencies

A survey of 307 enterprise technology leaders finds that as organizations rely more on artificial intelligence (AI) coding tools to build applications, they are simultaneously increasing the amount of open source software they are dependent on.

Conducted by the market research firm Moving Horizon on behalf of ActiveState, a provider of a platform for accessing hardened open source libraries, the survey also finds 89% of respondents work for organizations that are using AI coding tools in production environments. Among those respondents, 94% are using more open source software as a result, largely because it is much more readily accessible.

The paradox created as a result of that increased reliance on open source is that AI models are now surfacing more vulnerabilities in open source software than ever, many of which can now be exploited in a matter of hours.

ActiveState CEO Abby Kearns said that while the pace of application development has substantially improved, not enough organizations are fully appreciating the fact that the overall level of risk to their software supply chains has also increased. In fact, too many organizations are still not fully appreciating the impact exploits are about to have on application security as cybercriminals use AI both to exploit known vulnerabilities and to develop additional tactics and techniques, she added.

Historically, for example, DevSecOps teams would prioritize remediation efforts based on the severity and reachability of a vulnerability. However, it’s already been shown multiple times over how AI can be used to chain together multiple low-level vulnerabilities to create a more lethal exploit.

Overall, the survey finds 70% of respondents reporting their organization is using AI coding tools broadly, with 93% of respondents observing that efficiency has increased. A total of 91% also said release frequency has increased.

A full 94%, however, also noted that the amount of time required to remediate issues and clean up applications has also increased. A total of 91% report at least two hours per developer per week is now spent on these tasks, with 90% estimating at least 5% of engineering time is allocated to these tasks.

That suggests the pace at which applications are being built and deployed has increased, but there is still a significant amount of effort required to review code, said Kearns. For the moment, 71% of respondents said existing approaches to governance are able to scale up. Nevertheless, 61% report their organization has recently acquired new governance tools and 46% have increased governance staffing. A total of 70% have also crafted new policies for using AI code, while 68% increased developer training.

As the volume of code being created continues to increase, most organizations will need to further revisit how their software supply chain is constructed and secured, noted Kearns. In fact, the survey finds that half of respondents admit open source dependencies can find their way into production environments without review or approval.

More troubling still, more than three quarters of respondents acknowledge an unmanaged open source software dependency delayed a software release in the past year, with 58% also reporting they were subject to a compliance or audit finding. Just under a third (32%) also traced a security incident to an unmanaged dependency in the past two years.

A full 83% said the cost of managing open source software risks is also rising, the survey finds.

It’s not clear how long it might be before more organizations fully revisit how they build and deploy software in the AI era, but with each passing day, the one thing that is all too apparent is the level of risk is growing to a point that is likely to soon prove unsustainable.