The Dependency Boom: How AI Is Inflating Open Source Use

AI coding assistants are reshaping how software is built — but beneath the surface, they’re also accelerating one of the biggest shifts in modern development: an explosion of open-source dependencies and an equally steep rise in security risk.

According to the latest Synopsys OSSRA report, the amount of open-source code in the average commercial application nearly doubled in a single year. Developers are shipping faster than ever, but much of that velocity comes from automatically generated code — and that’s where the problem begins.

‍

The AI Effect: Code Generation on Autopilot

Tools like GitHub Copilot, ChatGPT, and Cody are writing millions of lines of code every day. They’re excellent at producing functional snippets quickly — but they’re also pulling in libraries, frameworks, and utilities without context or governance.

Each AI-written feature can add ten, twenty, or even fifty transitive dependencies. AI doesn’t check dependency age, license type, or patch cadence; it just writes code that compiles. The result is a rapidly growing web of third-party components entering production environments without oversight.

‍

The Hidden Pitfalls of AI-Generated Code

Recent research has revealed some unsettling trends about how AI generates code — and what it drags into your dependency tree.

1. Phantom Dependencies That Don’t Exist

A TraxTech study of more than half a million AI-generated code samples found that 20% of referenced dependencies didn’t exist at all in public repositories.

These “hallucinated” imports aren’t harmless. They create opportunities for malicious actors to publish packages under those fake names — a form of supply-chain attack known as slopsquatting — and quietly inject malware into production pipelines.

Source: TraxTech – 20% of AI-Generated Code Dependencies Don’t Exist

2. Insecure and Outdated Code Patterns

AI assistants frequently generate code using deprecated functions, unsafe defaults, or outdated libraries. A BuiltIn analysis of AI coding tools warns that they can “replicate existing insecure patterns” and generate exploitable code — especially when developers skip manual review under the assumption that the AI is “writing best practices.”

Source: BuiltIn – The Security Risks of AI Coding Tools

3. License and Compliance Blind Spots

AI doesn’t account for open-source licensing. It may suggest snippets or dependencies under restrictive licenses (GPL, AGPL, etc.) that can’t legally coexist with proprietary software, setting companies up for legal exposure down the road.

4. Dependency Sprawl and Hidden CVEs

Every auto-imported helper or library compounds technical debt. As these dependencies multiply, organizations inherit new CVEs, more patching overhead, and complex version conflicts — often without realizing it until a vulnerability scanner lights up.

5. No Ownership Path for Maintenance

AI can add dependencies, but it doesn’t own them. Once that code enters your repo, you become responsible for its patch lifecycle — even if the library is unmaintained, abandoned, or already end-of-life.

‍

From Innovation to Inheritance

AI-accelerated development feels like progress. But what’s really happening is a quiet accumulation of long-term risk.

Every dependency generated today becomes a maintenance obligation tomorrow. The industry is on track for a dependency bubble — a point where thousands of teams will face a choice between rewriting code or running unpatched, insecure software.

‍

How HeroDevs Can Help

This is exactly where HeroDevs’ Never-Ending Support (NES) comes in.

NES provides long-term, enterprise-grade maintenance for critical open-source frameworks — including those AI-generated or inherited through dependency chains. We deliver security fixes, dependency updates, and CVE remediation long after upstream support ends.

As AI continues to accelerate development, HeroDevs ensures organizations don’t sacrifice security for speed.

‍

The Bottom Line

AI is transforming how software is written — but without active dependency governance, it’s also multiplying your future attack surface.

The smart move isn’t to slow down; it’s to plan ahead.

Learn how HeroDevs helps teams future-proof their codebase before the dependency bubble bursts.

‍