AI's speed of writing code is faster than the security team's review speed. A new Linux Foundation study, sponsored and participated in by ActiveState, shows that 58% of teams are releasing code at a pace that exceeds what security reviews can keep up with; at the same time, 60% of respondents stated that AI programming assistants have increased the number of external software packages in their codebases. However, for these indirectly introduced dependencies, also known as "transitive dependencies," teams only review them about half of the time.
ActiveState is the sponsor and contributor to this new research. The study was supported by Open Source Security Foundation ( OpenSSF ) and LF AI & Data Foundation. ActiveState announced on Monday the research findings of "The Current State of AI's Impact on Software Security and Cybersecurity in 2026" ( State of AI Impact on Software Security and Cybersecurity 2026). The research indicates that there is a growing gap between the speed at which AI drives software development and the ability of organizations to produce secure code.
Research indicates that as AI accelerates both code generation and vulnerability discovery, these challenges are becoming more urgent, leaving organizations with less and less time to identify and fix issues before attackers can exploit security flaws. The PHP2Shell vulnerability in October 2026 highlighted this urgency: within just a few hours of the vulnerability being disclosed, an emergency patch was released, and attempts to exploit it were reported. As the speed at which vulnerabilities are identified and exploited continues to increase, organizations are under growing pressure to ensure that security reviews, dependency audits, and repair efforts keep up with the pace.
This survey covered 172 security professionals from enterprises and open-source projects. The survey also found that AI is also part of the solution, but it comes with some trade-offs. Respondents stated that 30% of the vulnerabilities discovered in the past year were detected with the help of AI auxiliary tools; 69% of the respondents said that these tools significantly improved their security posture. On average, AI tools increased the speed of security work by 17%, but false positives from the tools increased the workload for professionals by 30%, highlighting the need to strike a balance between the efficiency improvements brought by AI and effective security monitoring.
ActiveState CEO Abby Kearns stated: "The AI programming assistants don't just write code; they also select your dependencies. This research shows that teams only check about half of what comes with them. This is consistent with what we hear from customers on a weekly basis. Slowing down developers won't solve the problem. The solution is to decide in advance which components are trustworthy before the code enters the repository, so that developers and their AI tools can start with components that have already been approved by the security team."
Other main findings include:
- Skills are at risk. 82% of respondents agree that over-reliance on AI tools can weaken developers' security skills.
- Concerns exceed the level of preparedness. For each AI related threat that was measured, there were more practitioners expressing concern than those who believed they were well-prepared. The largest gap was observed in AI automated vulnerability exploitation generation and fuzz testing, with a difference of 41 percentage points.
- The supply chain tops the list of concerns. Supply chain attacks are the biggest worry for security experts, accounting for 93%; followed by injection vulnerabilities, which account for 90%; and the maintenance burden brought about by frequent component updates, which accounts for 87%.
- There is a lack of clear accountability. Only 30% of the teams have positions dedicated to addressing security threats related to AI, and only about one-third of the teams have formal security policies that cover AI.
- Clarity of ownership brings rewards. In teams that have dedicated AI security positions, 75% of respondents indicate that they are fully prepared for adversarial attacks targeting the AI system; whereas among all respondents, this proportion is 50%.
- Manual review is not a default requirement. In teams that adhere to the AI security policy, only 57% require manual review of code generated by AI.
The study indicates that these findings collectively suggest that as the adoption of AI increases, there is a need to more clearly define security responsibilities and strengthen governance. The study also points out that establishing dedicated positions, formulating clear policies, and correctly implementing tools are correlated with a higher level of preparedness; however, the survey did not prove that these practices led to any differences.
Laura Guazzelli states: "As AI accelerates software development, organizations also need to govern and protect the code produced with the same diligence. This begins with understanding which aspects of the software supply chain AI introduce risks, identifying who is responsible for addressing these risks, and ensuring that security practices keep up with changes in how software is built." OpenSSF is responsible for the security architecture of AI / ML / LLM / Agentic Systems.
The report recommends that organizations should designate a clear responsible person for AI related security threats, establish formal AI security policies, and incorporate manual review of generated code into these policies. At the same time, they should strengthen control over direct dependencies and transitive dependencies. Based on these findings, ActiveState suggests implementing governance at the point of introducing open-source components, in addition to scanning and review processes. This would allow the security team to decide which components can enter the software supply chain before developers or AI assistants pull them in.
The full report "2026 AI Impact on Software and Network Security" can be viewed on the Linux Foundation website. The content includes research findings and practical recommendations: https :// www.linuxfoundation.org / research / ai-impact-on-cybersecurity-2026
About ActiveState
ActiveState indicates that the company is committed to ensuring the security of the software supply chain from the source in the AI coding era. By leveraging ActiveState Curated Catalog – a private, audited open-source component repository – the security team can decide which components can enter the enterprise software before developers or AI programming assistants introduce them. The company states that this gives the security team control while maintaining the development speed of the engineering team. Curated Catalog can be used in conjunction with the component repositories, scanners, and AI programming assistants that the team is already using. For more information, see activestate.com.
Message source: ActiveState
