Overview
- Companies report that AI now writes a large share of production code, with Anthropic saying its model authored more than 80% of merged changes, which reduces human review time and raises execution risk.
- Large language models and automated agents can find bugs, generate exploits, test variants, and deploy changes at machine speed, which narrows the window for detection and response.
- Traditional supply-chain checks like SBOMs, signing, and provenance help track origins but do not show what code will actually do at runtime, so they are not enough to prevent malicious behavior.
- Security teams are adopting left-shifted controls such as pre-execution behavior checks, identity-first design, short-lived scoped credentials, stronger API authorization, and isolation to block risky execution paths.
- Hardware side-channel and cryptographic testing still require specialist measurement and signal-processing work, so defenders should combine continuous AI-assisted software testing with expert human review for full assurance.