The "State of the Software Supply Chain 2026" report by Sonatype analyzed more than 1.233 million malicious software packages; 1,700 vulnerability records; and 37,000 AI upgrade recommendations. The report reveals significant risks.

The report states that automation and AI are increasing open-source consumption with 9.8 trillion downloads, which is a 67 percent increase year-over-year.

This increases the operational burden across the open-source ecosystem, according to the experts. Open-source malware surpassed 1.233 million packages with cyber criminals mimicking trusted developer tools to launch new attacks.

Further, without any context or enforcement controls, AI has introduced new risk, leading to more rework needs for developers. An analysis of AI showed it hallucinated nearly 30 percent of component versions and suggested malware packages for use when it operated without real-time intelligence.

Software relying on those upgrades put organizations at risk. AI suggested or generated code is often accepted "as is". An average of nearly 40 percent of developers surveyed accepted AI-generated code without revision.

Source: https://www.sonatype.com/press-releases/sonatype-research-reveals-open-malware-grows-75-percent

Commentary

The above report reveals AI-generated or suggested code may steer developers toward malware, and even directly suggest or include it.

For organizations, this represents significant risks. The developer may not be malicious, but their negligence in utilizing AI by failing to review its output/suggestions can create risk by introducing malware into production systems faster than it is able to be detected.

What are the loss prevention options?

The first and most obvious option is to ban the use of AI in creating code. That may seem simple, but will require creating standards for employees and contractors, including audit and enforcement standards as well as penalties. Even if AI is banned, organizations should review all code prior to implementation to make certain employees and/or contractors do not work outside the standards.

If that is not an option, organizations should consider:

· Requiring AI to be thoroughly reviewed in real-time before being deployed to any production environments;

· Training developers regarding the risks of utilizing AI, including the risk of blindly relying on its output;

· Logging and audit AI use regarding coding so that any issues may be traced back to a specific origin point; and

· Requiring multi-step code verification in order to help increase the likelihood that hidden malware can be discovered.

The final takeaway is if an organization is going to continue to use AI for coding, organizations must ensure any AI suggested or generated code is carefully reviewed before it is implemented to lower the risk of malware.