AI Agents Pick Your Dependencies Now—And Attackers Are Weaponizing the Same Tools

Artificial intelligence has turbocharged both software creation and software attacks, with the collision point increasingly visible in the supply chain. Developers now rely on AI agents to write code and select dependencies, while threat actors use frontier models to discover vulnerabilities and chain seemingly minor weaknesses into viable attack paths. The velocity of change is staggering: GitHub handled approximately one billion commits in 2025, and by April 2026 was processing roughly 275 million commits weekly, according to GitHub COO Kyle Daigle. GitHub Actions compute usage has climbed from 500 million minutes per week in 2023 to 2.1 billion in a single week this year.

The shift in how code gets written is reshaping the security landscape. Quincy Castro, CISO at Chainguard, observes that manual coding now feels antiquated. "I look around Chainguard, and I don't think any of our engineers have actually written a line of code by themselves in the past year," Castro tells The New Stack. Writing code manually "sort of feels quaint, like you're illuminating manuscripts," he says, while "the printing press is out there just going to town."

Beyond professional engineering teams, AI has democratized software creation. Teams in HR, finance, and business intelligence can now build applications without waiting for engineering resources. This expansion means more software authored by people outside traditional development roles, often with AI making critical decisions about which libraries and packages get incorporated. The person prompting the agent may never see which dependencies it has selected.

When the agent chooses the dependencies

Software security has long operated under the assumption that humans cannot inspect everything. Developers, however, retained control over which libraries and packages entered applications. That assumption breaks down when AI agents handle much of the coding work.

Humans are directing what they want to be done, but they're somewhat abstracted from the actual doing of the work.

Quincy Castro, CISO at Chainguard

Castro explains the shift: "You have AI instead now making the choices of what dependencies am I going to pull into this application? How am I going to go accomplish this task?" Attackers are deploying the same technology with devastating effect. Castro identifies three converging threats: frontier models discovering previously unknown vulnerabilities, attackers using agents to exploit unpatched weaknesses, and sustained campaigns targeting the open-source ecosystem.

Collections of medium- and low-severity findings once languished at the bottom of remediation queues. Advanced frontier models, including Anthropic's Claude Mythos Preview and OpenAI's GPT-5.6-Cyber, can now traverse these findings and chain minor weaknesses into functional attack chains. "Here's a whole ton of mediums and lows. Now give me the attack path that gets me domain admin," Castro describes the approach. "Chain these together to go get me root on the system. And AI is really, really good at being able to do that."

This capability creates a vulnerability management crisis. Mean time-to-exploit has collapsed from 63 days in 2018–19 to an estimated minus seven days in 2025, according to Mandiant—meaning exploitation can begin before defenders have patches available. OpenAI released GPT-5.6-Cyber in August, with models continuing to strengthen. AI's ability to combine lower-severity flaws also undermines CVSS-based remediation queues as representations of actual attacker capability.

Open source becomes the attack path

Modern applications depend heavily on open-source software, and attackers have increasingly targeted the infrastructure used to build and distribute it. The TeamPCP campaign compromised widely used projects including Aqua Security's Trivy, pushing malicious code into trusted components that were subsequently picked up downstream.

Supply chain attacks were once the domain of sophisticated state-backed groups with resources to spend on targeted infiltration. That barrier is eroding. "If you don't mind making some noise, this is a way easier attack vector than I think a lot of people thought it was," Castro says. "More importantly, a single attack that's successful can lead to a cascading set of other compromises and other access that gets you into other places."

Development pipelines amplify the risk. Many organizations maintain minimal controls around CI/CD while developers routinely pull external components to complete their work. Autonomous coding tools compound this behavior. Castro compares the practice to inserting an unknown USB drive into production infrastructure.

You wouldn't pick up a random thumb drive and stick it into a production system, right? But that is effectively what folks are doing when they're consuming open-source software that way.

Quincy Castro, CISO at Chainguard

Open source itself is not the problem. The issue lies in trusting its distribution path without adequate verification of what is being consumed.

Prevention has to come before detection

The traditional security model—scan, alert, assess, remediate—becomes unsustainable as development output multiplies, AI agents make more underlying decisions, and attackers exploit weaknesses before fixes exist. Castro advocates shifting focus upstream, toward controlling what enters the development environment rather than discovering problems after software is already built.

"How do we just make things work from the beginning, with no alerts and no responding to stuff and no people chasing things and no people trying to prove a negative?" he asks. "From end to end, from the creation of code to its deployment, how do we make sure that we can give folks the most trustworthy version of that thing?"

This philosophy underpins Chainguard's approach to containers, libraries, and open-source artifacts. Rather than accepting packages from public ecosystems and scanning them afterward, the company builds artifacts from verified, buildable source and provides provenance documentation about their creation.

Trustworthy components alone are insufficient. "There's no point in bringing inherently secure software components into the environment if you don't actually have a technical control that says this is the only way people developing code can consume these things," Castro says. Engineering, security, and SRE teams need controls governing where software—whether selected by humans or AI agents—can originate.

This requires layered protection: knowing where software came from and how it was built, controlling what can enter environments, and enforcing those rules consistently whether an AI agent or developer selects components.

Defending open source at AI speed

Frontier models are not merely discovering previously unknown vulnerabilities—they are combining lower-severity flaws into working attack paths. Individual companies can harden their own pipelines, but the open-source ecosystem they depend on faces vulnerability discovery at a speed and scale it was not designed to handle.

Athena, an industry coalition Chainguard launched, aims to convert vulnerability findings from frontier AI programs into fixes. As of July, the coalition had processed more than 40,000 vulnerabilities, with 42% rated critical or high severity and 86% marked as network reachable, meaning attackers can access and trigger them at the network level.

Castro emphasizes that finding more bugs is not the critical challenge—AI already excels at that. Someone still needs to fix them.

Through Athena, what we attempt to do is to give people that engineering fix. What if we create a coalition where folks just send us the issues that they're finding? We automatically generate fixes for those, and we push those back to everybody.

Quincy Castro, CISO at Chainguard

These fixes can be pushed upstream to open-source maintainers, who face the prospect of being overwhelmed by expanding volumes of AI-generated vulnerability reports.

AI may ultimately force a fundamental shift in how software security operates. Developers will not abandon coding agents because they introduce risk, just as companies will not stop using open source because attackers target it. Bolting additional scanning onto an exponentially faster development process offers no real solution.

The path forward involves removing risk before software reaches developers or agents: starting with components that can be trusted, tightly controlling how they enter environments, and fixing weaknesses as close to their source as possible. AI has made software creation dramatically cheaper. It is doing the same for attacks. Security must keep pace without halting progress.