The increasing use of AI coding tools has created a challenge for organizations in terms of vetting the code used in their development pipelines. According to ActiveState, these tools can introduce unvetted or "hallucinated" open source dependencies at a pace that surpasses the capacity of traditional security reviews.
This issue arises because AI coding tools can automatically generate code and suggest dependencies, which may not have undergone thorough security checks. As a result, organizations may inadvertently introduce vulnerabilities into their systems, potentially compromising their security and integrity.
ActiveState suggests that organizations should take a proactive approach to governing packages at the point of selection, before they enter the development pipeline. This approach would enable organizations to ensure that only trusted and secure dependencies are used in their projects, reducing the risk of security breaches and other issues.
The scale and speed at which AI coding tools can introduce new dependencies highlight the need for a more efficient and effective approach to code vetting. Traditional security reviews may not be able to keep pace with the rapid introduction of new dependencies, making it essential for organizations to adopt new strategies for governing open source ingestion.
By governing packages at the point of selection, organizations can better manage the risks associated with open source dependencies and ensure the security and integrity of their systems. This approach requires a careful evaluation of the dependencies used in development projects, as well as the implementation of robust security measures to prevent the introduction of vulnerabilities.
As the use of AI coding tools continues to grow, the importance of effective code vetting and governance will only increase. Organizations must be aware of the potential risks associated with these tools and take steps to mitigate them, in order to protect their systems and maintain the trust of their users.
<small>Source: Bleeping Computer — read the original story there.</small>
