AI Is Rewriting the Software Supply Chain — Can Security Keep Up?

The way software is produced is being rewritten by AI. Code once written line by line is now largely model-generated; dependencies once carefully vetted are now pulled in automatically by agents inside a workflow. When the speed of production jumps by an order of magnitude, security that still relies on "one scan before release" degrades from gatekeeper to after-the-fact auditor.

Three assumptions that are breaking

Traditional software composition analysis rests on a few implicit assumptions — and they are falling one by one.

• Dependencies are added by humans: developers know what they pulled in. In agent-driven development, a dependency can be silently swapped during an automated refactor.
• A package name equals its contents: declaring requests means requests. Typosquats and hijacked versions make the name untrustworthy.
• Detection and remediation are separate stages: scan, then schedule, then fix. When code iterates by the minute, that round trip simply can't keep up.

Security must shift to the moment of production

The answer is not to scan faster, but to embed security into the production round itself. The moment a developer (or an agent) writes the code, detect the issue, deliver an applicable fix, and verify it immediately — converging "finding" and "fixing" into a single turn.

When production is real-time, security must be real-time too. An after-the-fact inventory can never catch up with real-time production.

From "inventory" to "capability"

SBOM answers "what did I use." But the real question in the AI era is "what can it do once enabled." A Skill, an MCP server, an agent tool — each introduces not just code, but a set of capabilities and permissions. The next stop for security is to move from a static composition inventory to dynamic capability auditing.

That is exactly why we built CleanCode, CleanSource SCA, and SkillSec: to let security keep pace with AI rewriting software.