AI code undermines control over open source and IP

"While AI tools are lowering the barrier to development, the gap between speed and manageability is growing. In just over a year and a half, AI code assistants have grown from an experiment to an integral part of modern development environments. They are driving strong productivity growth, but organizations are not keeping up with the associated security and governance issues."

"This complexity directly leads to more vulnerabilities. For the first time, the average number of open-source vulnerabilities per codebase has more than doubled. Virtually all codebases examined contain security issues, often with a high or critical risk level. At the same time, attacks on the software supply chain are increasing, with attackers increasingly targeting the open-source ecosystem itself."

"AI systems generate code fragments derived from copyleft licenses without including the associated license information. This puts organizations at risk of unintentionally violating license terms. Because not all companies actively monitor AI-generated code, legal risks often remain hidden for a long time."

Generative AI has rapidly transformed software development, increasing productivity but outpacing security and governance capabilities. The OSSRA Report 2026 reveals that AI code assistants have become integral to development environments within eighteen months, driving significant productivity gains. However, organizations struggle to manage associated risks. Codebase complexity has grown substantially, with increased files and open-source components. Vulnerabilities have doubled on average, with virtually all examined codebases containing security issues at high or critical risk levels. Supply chain attacks targeting the open-source ecosystem are escalating. Additionally, license conflicts have reached unprecedented levels, with two-thirds of codebases containing conflicting licenses. AI systems generate code from copyleft sources without proper license attribution, creating unintended legal violations that often remain undetected.

Read at Techzine Global