Chainguard has rebuilt nearly one million unique versions of Java dependencies, including enterprise essentials such as Spring Boot, Jackson, Apache Commons, and Log4j, using the Chainguard Factory, an automated platform for creating software builds based on code originally found in open source software repositories.
This is a state where we see that the teams that move fastest will be the ones with clear tests, tight review policies, automated enforcement and reliable merge paths. Those guardrails are what make AI useful. If your systems can automatically catch mistakes, enforce standards, and prove what changed and why, then you can safely let agents do the heavy lifting. If not, you're just accelerating risk,
Results of the survey, conducted in April, have been compiled into GitLab's 2024 Global DevSecOps Report, which was announced June 25. Among the findings, 78% of respondents said they are currently using AI in software development or plan to in the next two years, an increase from 64% of respondents who said they were using or planning to use AI in development last year.
Even incidents like the Colonial Pipeline ransomware attack, which showed us how the cyber world and our physical lives intersect, stopped far short of societal disruption. However, the threat of cyberwar has been building, influenced by advancements in AI and increased presence of actors in U.S. systems and telecommunication networks. A military conflict could escalate these attacks to scale, crippling critical infrastructure and public safety systems like power grids, transportation networks and emergency response, even disrupting military communications and undermining response.
As software application development teams now start to embrace an increasing number of automation tools to provide AI-driven (or at least AI-assisted) coding functions in their codebases, a Newtonian equal and opposite reaction is also surfacing in the shape of governance controls and guardrails to keep AI injections in check as these technologies now surface in the software supply chain.
At first glance, it appeared to be a simple utility aimed at developers working on Discord bots using the Discord.py library, however, the package concealed a fully functional remote access trojan (RAT).