AI coding tools accelerate dependency sprawl and widen malware risk

AI coding assistants pull open-source packages, libraries and container images into enterprise codebases faster than security teams can review them, widening dependency sprawl and supply-chain risk from malicious, typosquatted or compromised transitive dependencies. Chainguard CISO Quincy Castro says velocity has outpaced governance as day-long review cycles lag behind instant code generation; agents choose libraries by prompt fit, not maintenance, and citizen developers assemble software without traditional validation.