# Linux Foundation Reports AI Software Security Gaps

A Linux Foundation study sponsored by ActiveState found that AI-assisted software development is outpacing security governance: 58% of surveyed teams ship code faster than security reviews can keep pace, and teams vet transitive dependencies only about half the time. The report identifies no specific government solicitation, award, or contract, but its findings are relevant to agencies and contractors that procure or develop software because they highlight potential gaps in code review and software-component controls.

- Procurement teams can use the findings to assess whether software suppliers have clear ownership for AI-related security risks, human review practices, and controls for components entering development pipelines.
- Contractors can evaluate whether their existing development and supplier-security processes address AI-generated code and the vetting of transitive dependencies; the study does not establish a new mandatory requirement.
- The research points to software supply-chain security as a consideration in acquisition and vendor discussions, rather than identifying a specific funding or contracting opportunity.

**Jurisdictions:** international
**Industries:** Information Technology
**Topics:** Cybersecurity, Artificial Intelligence
**Published:** November 09, 2026

### Vendors
- ActiveState (Research sponsor and software supply-chain security product provider)

### Key Quotes
> As AI accelerates software development, organizations need to be just as deliberate about how they govern and secure the code being produced. That starts with understanding where AI is introducing risk into the software supply chain, establishing clear ownership for addressing it, and ensuring security practices can keep pace with how software is built.
> — Laura Guazzelli, Security Architect for AI/ML/LLM/Agentic Systems at OpenSSF

> AI coding assistants don't just write code. They choose your dependencies, and this research shows teams are checking only about half of what comes along for the ride. That matches what we hear from customers every week. Slowing developers down won't fix it. The answer is to decide what's trusted before it reaches the codebase, so developers and their AI tools start from components security has already approved.
> — Abby Kearns, CEO of ActiveState

### Sources
- [AI Is Writing Code Faster Than Security Can Review It, Finds New Linux Foundation Research Sponsored by ActiveState](https://finance.yahoo.com/technology/ai/articles/ai-writing-code-faster-security-160000548.html) - Yahoo Finance