How AI-Generated Code Compromises Software Supply Chain Security

Project Glasswing exposes a critical blind spot: AI tools generating code, suggesting dependencies, and executing commands operate without the oversight mechanisms traditional security tools provide. The research identifies three emerging attack vectors—hallucinated package names registered by attackers, business context leaked through API calls, and unsupervised AI agents with repository access—that existing security infrastructure like Dependabot and SBOM tracking cannot detect. This fundamental shift in how supply chains can be compromised demands organizations rethink their security validation processes in an AI-assisted development era.