AI-Generated Dependency Recommendations Can Add Supply Chain Risk

Summary

The article argues AI-generated development can amplify unsafe or unnecessary dependency choices, citing Sonatype and external research, and recommends live supply-chain intelligence, automated policy guardrails, and tracking remediation costs.

Key points

Sonatype’s analysis of nearly 37,000 dependency upgrade recommendations found LLM-generated recommendations delivered the smallest security improvement among the strategies studied; 345 recommendations increased risk, including by selecting versions with more CVEs or packages compromised after training.
Across 856 enterprise applications, choosing the newest dependency version produced strong security results but was estimated to cost nearly $30,000 per application in engineering work.
A cited 2026 study of 117,062 dependency changes across seven ecosystems found AI agents selected known-vulnerable versions more often than human developers; 36.8% of vulnerable agent-selected dependencies required a major-version upgrade, versus 12.9% of vulnerable human selections.
Sonatype Research said it identified and blocked 234 open-source malware packages attributed to the Lazarus Group between January and July 2025; more than 120 acted as droppers for additional malware.
Sonatype reported zero hallucinated versions when validating recommendations for the same 36,870 components against live repositories, proprietary vulnerability and malware intelligence, and breaking-change calculations.
The article recommends grounding AI tools in current package and vulnerability intelligence, enforcing automated policies on dependencies throughout development, and measuring build failures, vulnerability changes, dependency growth, and remediation work.