Topic starter
18/08/2026 2:31 pm
TL;DR: AI coding assistants can materially increase productivity while expanding code, dependency, and API sprawl, according to Apiiro’s analysis of thousands of repositories, with Copilot-active repositories showing 43% more OSS packages per commit and a 40% rise in API surface over six months. The governance problem is no longer adoption itself, but whether security teams can inventory, gate, and remediate AI-amplified change fast enough.
Editorial analysis by NHI Mgmt Group, based on content published by Apiiro: “More Code = Wider Attack Surface: AI Coding Assistants Deliver Productivity at the Cost of More Endpoints and More OSS Sprawl”.
By the numbers:
- Copilot-active repositories have 43% more OSS packages per commit than repositories without Copilot usage.
- Between June and October 2025, API surface records grew from 54,627 to 79,630.
- Apiiro’s analysis covered 26.5K repositories, 14K developers, 4.7M OSS package records, and nearly 80,000 APIs in code.
Key questions
Q: How should security teams govern AI-assisted code that keeps adding new packages and APIs?
A: Treat AI-assisted code as governed change, not just developer output.
Q: Why does AI-driven coding increase application security risk even when it improves productivity?
A: Because productivity gains increase change volume faster than teams can classify and review the resulting software.
Q: What are the signs that AI-generated code is creating unmanaged sprawl?
A: Look for rising dependency counts, multiple libraries doing the same job, new APIs that are not in the service catalog, and a growing gap between code changes and security review capacity.
Practitioner guidance
- Implement inventory-first governance for code output Maintain a live system of record for APIs, libraries, and build-time dependencies so AI-generated changes are visible before they ship.
- Enforce approved-library policies in the IDE and pipeline Block net-new packages unless they match an approved list or pass an explicit justification workflow in pull request and build checks.
- Use automated reachability analysis for dependency findings Prioritise vulnerabilities that are actually reachable in the application path instead of opening manual triage tickets for every scan result.
Bottom line: AI coding assistants can improve throughput while still increasing software risk, because faster code generation tends to expand dependencies and endpoints faster than teams can govern them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:19 pm
AI-assisted development is becoming an attack-surface generation problem, not just a productivity problem. The article shows that assistants are accelerating code, dependency, and endpoint creation faster than security teams can govern. That shifts the core question from whether teams should use AI to whether they can still control what AI causes to be built. Practitioners should treat AI-assisted code as governed supply chain change, not just faster authoring.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: When should teams prioritise policy-as-code over manual approval handling?
A: Teams should prioritise policy-as-code when the same access request can be judged differently by different reviewers or at different times. If consistency, auditability, and repeatability matter, code-based policy becomes the more reliable control plane because it reduces drift and makes exceptions visible.
👉 Read our full editorial: AI coding assistants are widening API and OSS attack surface