Notifications
Clear all
Topic starter
18/08/2026 2:31 pm
TL;DR: AI coding assistants can materially increase productivity while expanding code, dependency, and API sprawl, according to Apiiro’s analysis of thousands of repositories, with Copilot-active repositories showing 43% more OSS packages per commit and a 40% rise in API surface over six months. The governance problem is no longer adoption itself, but whether security teams can inventory, gate, and remediate AI-amplified change fast enough.
NHIMG editorial — based on content published by Apiiro: AI coding assistants are widening API and OSS attack surface
By the numbers:
- Copilot-active repositories show 43% more OSS packages per commit than repositories without Copilot usage.
- Between June and October 2025, API surface records grew from 54,627 to 79,630, representing roughly a 40% increase in attack surface in under six months.
- Apiiro reports that AI-assisted teams shipped 10x more security findings in code than non-assisted teams.
Questions worth separating out
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.
Q: Why do AI coding assistants increase AppSec governance risk?
A: They increase risk because they optimise for speed and plausible output, not for context-aware security validation.
Q: What breaks when organisations do not maintain a complete API inventory?
A: Unknown and stale endpoints stay reachable, which means security controls, logging, and retirement processes miss part of the attack surface.
Practitioner guidance
- Implement continuous inventory for APIs and OSS packages Create a live system of record for endpoints, dependencies, and service relationships so new code cannot outpace visibility.
- Enforce approved-library paths in the developer workflow Publish a golden-path catalogue for common functions such as HTTP clients, logging, and serialization, then flag or block alternative packages when AI suggestions diverge from approved standards.
- Add dependency justification gates to CI/CD Require a human explanation when a pull request introduces net-new packages, duplicate implementations, or high-blast-radius libraries.
What's in the full report
Apiiro’s full research covers the operational detail this post intentionally leaves for the source:
- Repository-level methodology across 26.5K repositories, 14K developers, and 4.7M OSS package records
- The Copilot-versus-non-Copilot comparison tables for commits, developers, packages, and packages per commit
- Detailed examples of package duplication patterns across HTTP, serialization, cryptography, and logging libraries
- Implementation guidance for inventory-first security, prompt-level guardrails, and automated remediation
👉 Read Apiiro’s analysis of AI coding assistants, OSS sprawl, and API attack surface growth →
AI coding assistants and attack surface sprawl: what changes now?
Explore further
18/08/2026 3:19 pm
AI-assisted code sprawl is becoming an access-governance problem, not just a software hygiene problem. Every new API endpoint and dependency creates new places where authentication, authorisation, secrets, and service identities must be governed. That means the blast radius of poor development choices now extends into IAM and NHI controls, especially where applications rely on tokens, service accounts, and automated delivery chains. Practitioners should treat code sprawl as an entitlement sprawl precursor.
A question worth separating out:
Q: How do organisations reduce the impact of AI-driven dependency sprawl?
A: Contain it early with approved-path catalogues, commit-time policy checks, and automated remediation for repetitive violations. In parallel, use reachability analysis so the highest-risk issues rise first. That combination reduces noise while preserving developer speed and improving governance accuracy.
👉 Read our full editorial: AI coding assistants are widening API and OSS attack surface
