TL;DR

• AI coding assistants and agents pull open source dependencies into your code at machine speed, often without anyone checking the package name.
• The mechanisms are specific: hallucinated package names that attackers register (slopsquatting), outdated versions with known vulnerabilities, and dependency trees nobody chose.
• Scanners remain the backstop. They tell you what got in.
• The control that holds at AI speed is at the source: developers and AI coding assistants pull from one vetted repository of open source components.
• Control at the source. Keep the speed without the remediation bill.

How AI coding tools pull open source into your code

AI coding assistants now suggest and install open source dependencies as part of generating code. A developer accepts the suggestion, and the package arrives without the manual review that used to catch a bad one.

That changes the security question for every team writing code with AI. The issue is control over what your AI tools are allowed to pull in. The same pattern now extends to the MCP servers and agent skills that coding agents install, each one more component arriving from outside your review process.

Three ways AI-introduced dependencies create risk

Hallucinated packages and slopsquatting. Language models sometimes recommend packages that don't exist. Attackers register those names on public registries and wait for the next assistant to suggest them.

Outdated versions with known vulnerabilities. Models learn from code written before their training cutoff. They often suggest versions that were current then and vulnerable now.

Dependency trees nobody chose. One accepted suggestion can bring an entire tree of open source components with it. Malicious open source packages are already rising fast: detections increased 73% in 2025.[1] In ActiveState's research report, The AI Remediation Bill, 96% of respondents say AI has increased dependency growth.[2]

What it costs when an unvetted package gets in

The cost rarely lands in one budget. It shows up as rework, release delays, audit findings, and incidents, each owned by a different team, so no one sees the whole bill.

Regulators expect you to know and control what's in your software. Under the EU Cyber Resilience Act, manufacturers must report actively exploited vulnerabilities and severe incidents from September 11, 2026, starting with an early warning within 24 hours.[3] You're accountable for what AI pulls into production on your behalf.

Why adding more review falls behind

The usual response is to detect and react: add scanners, staff, and policies. Each addition grows the capacity to respond, and the model stays the same. When AI pulls open source in faster than people can review it, the review queue grows with it. In ActiveState's research report, The AI Remediation Bill, 80% of Ready-to-Act Leaders, the enterprises furthest along, don't consistently review AI-introduced dependencies (a directional figure).[2]

Scanning stays essential as the backstop. Scanners tell you what got in. Control at the source decides what gets in, so your scanner has less to find and a cleaner signal.

How to govern dependencies pulled in by AI

Security teams that keep pace with AI coding tend to do five things:

1. Choose one trusted source for open source. Developers and AI coding assistants pull from a private, vetted repository in place of public registries.
2. Point AI coding assistants at that source. When an assistant requests a dependency, it resolves from the repository you control.
3. Know where your packages came from. Each component has a documented build origin before anyone installs it.
4. Assign remediation ownership. When a vulnerability lands, someone delivers the remediated component on a committed timeline, so the work leaves your backlog.
5. Keep the scanner running. It confirms what the source already governs.

How ActiveState helps

The ActiveState Curated Catalog is a private, vetted repository of open source components that lets developers and AI code generators build safely without scouring the open internet. It replaces public registries like PyPI, Maven, and npm, and works with the artifact managers your teams already run, including JFrog Artifactory and Sonatype Nexus. See the full list on the integrations page.

Dependencies requested by AI coding assistants resolve from the Curated Catalog, across 10 language ecosystems. Developers keep using native commands such as pip, npm, and maven, so engineering keeps its existing speed.

ActiveState builds open source from source in a SLSA Level 3 build environment and generates SBOMs automatically. Managed components are updated on contractual SLAs: 5 business days for critical CVEs, 10 business days for high, and 30 business days for all others, with the clock starting when a fix is available upstream. Your scanner keeps running, with roughly 68% less noise from false positives.

For security teams, this is the safe decision, made once, at the source, for every dependency request that resolves from the catalog. For a wider view of the tool categories involved, read how to evaluate software supply chain security tools.

Next step

Ready to secure your software supply chain from the source? Contact ActiveState today to see how it works.

Sources

1. ReversingLabs, "ReversingLabs 2026 Software Supply Chain Security Report Identifies 73% Increase in Malicious Open-Source Packages," January 27, 2026. https://www.reversinglabs.com/press-releases/reversinglabs-2026-software-supply-chain-security-report-identifies-73-increase-in-malicious-open-source-packages
2. ActiveState, "The AI Remediation Bill," research by Moving Horizon, September 2026. https://go.activestate.com/ai-remediation-bill
3. European Commission, "Cyber Resilience Act: Reporting obligations," Shaping Europe's digital future, 2026. https://digital-strategy.ec.europa.eu/en/policies/cra-reporting