When AI writes code: how software supply chain security is changing

Colleagues, I’d like to highlight a shift in cyber risk and the software supply chain.

AI is part of software build pipelines: code is written by agents, dependencies may be pulled in automatically, and prompts are becoming a new attack surface.

It is no longer enough to review the final code alone. We must also account for the model, the agent, and the tools they invoke, including MCP and related configurations.

I see two priorities here: end-to-end provenance across the pipeline, and a focus not on the number of findings, but on those that are truly exploitable.

Why this matters: if AI is involved in development, we need to secure not only the repository, but the entire logic behind artifact creation.

How do you assess these risks in your own processes?
#cybersecurity #SoftwareSupplyChain #AIsecurity #DevSecOps