AI is writing code faster than security teams can review it. A new Linux Foundation study, sponsored and participated in by ActiveState, shows that 58% of teams are releasing code faster than security reviews can keep up; meanwhile, 60% of respondents reported that AI programming assistants have increased the number of external packages in their codebases. However, teams only review these indirect dependencies—known as transitive dependencies—about half the time.
ActiveState is the sponsor and contributor to this new research, which is supported by the Open Source Security Foundation (OpenSSF) and the LF AI & Data Foundation. ActiveState unveiled the findings of the report "State of AI Impact on Software Security and Cybersecurity 2026" on Monday. The research reveals a growing gap between the speed of AI-driven software development and organizations' ability to secure the code they produce.
Research indicates that as AI simultaneously accelerates code generation and vulnerability discovery, these challenges are becoming more urgent, leaving organizations less time to identify and fix issues before attackers exploit them. The PHP2Shell vulnerability in October 2026 highlighted this urgency: emergency patches were released within hours of disclosure, and exploitation attempts were already reported. The study notes that as the speed of vulnerability identification and exploitation continues to increase, organizations are under growing pressure to ensure that security reviews, dependency audits, and remediation efforts can keep pace.
The survey covered 172 security professionals from enterprises and open-source projects. It also found that AI is part of the solution, but comes with trade-offs. Respondents reported that 30% of vulnerabilities discovered in the past year were detected using AI-assisted tools; 69% said these tools significantly improved their security posture. On average, AI tools accelerated security work by 17%, but false positives increased workload by 30%, highlighting the need to balance the efficiency gains from AI with effective security oversight.
Abby Kearns, CEO of ActiveState, said: “AI programming assistants don’t just write code—they also select your dependencies, and this research shows teams only review about half of what follows. This aligns with what we hear weekly from our customers. Slowing down developers isn’t the solution. The answer is determining upfront which components are trustworthy, so developers and their AI tools can start with components already approved by security teams.”
Other key findings include:
- Skills are at risk. 82% of respondents agree that over-reliance on AI tools undermines developers' security skills.
- Concern exceeds preparedness. For each AI-related threat measured, more practitioners expressed concern than believed they were prepared. The largest gap was in AI-automated exploit generation and fuzz testing, at 41 percentage points.
- Supply chain tops the list of concerns. Supply chain attacks are the top security concern for experts, at 93%, followed by prompt injection at 90%, and the maintenance burden from frequent component updates at 87%.
- Responsibility is unclear. Only 30% of teams have dedicated roles for managing AI-related security threats, and only about one-third have formal security policies that include AI.
- Clear accountability leads to better outcomes. Among teams with dedicated AI security roles, 75% reported they are adequately prepared for adversarial attacks against AI systems, compared to 50% of all respondents.
- Manual review is not a default requirement. Among teams with AI security policies, only 57% require manual review of AI-generated code.
The study finds that these findings collectively suggest that as AI adoption increases, there is a greater need to clearly define security responsibilities and strengthen governance. The study also notes that establishing dedicated roles, implementing clear policies, and properly deploying tools are associated with higher levels of preparedness; however, the survey does not prove that these practices cause the differences.
Laura Guazzelli, Security Architect for AI/ML/LLM/Agentic Systems at OpenSSF, said: “As AI accelerates software development, organizations must govern and protect the resulting code with equal diligence. This begins with understanding where AI introduces risks into the software supply chain, clarifying who is responsible for addressing these risks, and ensuring that security practices keep pace with changes in how software is built.”
The report recommends that organizations designate clear accountability for AI-related security threats, establish formal AI security policies that include manual review of generated code, and strengthen controls over both direct and transitive dependencies. Based on these findings, ActiveState recommends implementing governance at the point of introduction for open-source components—enabling security teams to determine which components are permitted into the software supply chain before developers or AI assistants pull them in.
The full report, "The State of AI's Impact on Software and Cybersecurity in 2026," is available on the Linux Foundation website, including research findings and practical recommendations: https://www.linuxfoundation.org/research/ai-impact-on-cybersecurity-2026
About ActiveState
ActiveState states that the company is committed to securing the software supply chain at its source in the era of AI-powered coding. With the ActiveState Curated Catalog—a private, vetted repository of open-source components—security teams can determine which components are allowed into enterprise software before they are introduced by developers or AI coding assistants. The company says this gives security teams control while maintaining the development velocity of engineering teams. The Curated Catalog integrates with the artifact repositories, scanners, and AI coding assistants teams are already using. Learn more at activestate.com.
Source: ActiveState