Linux Foundation report highlights AI-driven dependency growth and security maintenance gaps

A new report titled "State of AI Impact on Software Security and Cybersecurity 2026" from LF Research reveals that AI-assisted development is significantly impacting software supply chains. The study, sponsored by OpenSSF and LF AI & Data, found that 60% of surveyed organizations report an increase in external dependencies due to the use of AI coding tools.

This influx of new code is outpacing the ability of security teams to perform adequate reviews. While 83% of practitioners expressed concern regarding the high volume of component updates required for maintenance, only 44% feel prepared to handle the workload. The report identifies a growing "security debt" caused by the tension between rapid deployment and the risk of breaking production environments during patching.

Technical findings on AI and supply chain security

• Dependency Proliferation: 60% of surveyed projects and organizations report that AI coding tools have increased their total number of external dependencies, while only 16% reported a decrease.
• Transitive Risk: Security teams are only reviewing transitive dependencies—the packages brought in by their primary dependencies—approximately 50% of the time.
• Review Bottlenecks: 58% of respondents indicate that software is being shipped faster than security review processes can accommodate.
• Patching Obstacles: The primary reasons for delaying security fixes are the risk of breaking existing functionality (28%) and a lack of available time (22%).
• Organizational Preparedness: Teams with a dedicated security role or formal AI security policy showed higher preparedness across all surveyed threat categories, yet only 30% of teams currently have such a role.

Why it matters

For Linux distributions and open-source maintainers, this highlights a critical need for better automated testing to mitigate the fear of breaking changes during updates. As AI tools increase the complexity of software dependency trees, the ecosystem must prioritize vetted, policy-governed sources to prevent unmanaged security debt from accumulating in critical infrastructure.