# AI Agents Increase Software Supply-Chain Risk

AI coding assistants and autonomous agents can select software dependencies and execute package code faster than traditional review processes can assess them, increasing the risk of compromised or untrusted components entering government contractors’ software builds. The article discusses Indian Computer Emergency Response Team (CERT-In) guidance and highlights demand for controls that verify software provenance and integrity before build entry, generate auditable SBOM/QBOM/CBOM evidence, and track remediation continuously. It identifies no specific procurement, solicitation, contract value, or deadline.

- Contractors and procurement teams can use dependency provenance, package integrity checks, auditable component inventories, and remediation tracking as considerations when evaluating software supply-chain security capabilities.
- The article points to a potential need for procurement requirements and supplier evidence that address risks from AI-assisted dependency selection and package execution; it does not describe a new mandate or specific contract opportunity.
- The CERT-In reference is specific to India; the signal does not establish that its guidance applies as a requirement to other jurisdictions.

**Jurisdictions:** international
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** November 07, 2026

### Government Entities
- Indian Computer Emergency Response Team (CERT-In)

### Vendors
- CleanStart (Software supply-chain security solution provider)

### Key Quotes
> Ultimately, we want to help India’s enterprises move from assumed trust to verified trust.
> — Anil Dhoot, Country Manager, India & SAARC at CleanStart

### Sources
- [The AI Dependency Explosion: Safeguarding Software Supply Chains Against Autonomous Package Ingestion](https://cxotoday.com/corner-office/the-ai-dependency-explosion-safeguarding-software-supply-chains-against-autonomous-package-ingestion) - CXOToday.com