AI-Generated Code and Open Source Risk: What OSSRA 2026 Found
Cloud Platform EngineeringThe average commercial codebase now contains 581 open source vulnerabilities. That’s not a long-tail problem — it’s the median, across 947 codebases and 17 industries, according to the 2026 Black Duck Open Source Security and Risk Analysis.
Black Duck’s annual OSSRA report is the closest thing the industry has to a census of open source composition and risk in production software. This year’s analysis found vulnerability counts up 107% year-over-year, a figure that’s hard to explain without accounting for the compound effect of AI-generated code incorporating open source dependencies without adequate evaluation.
The Scale of the Accumulation Problem
Open source’s presence in commercial software is effectively universal: 96% of audited codebases contain open source components, with some industry segments reaching 98%. That baseline has been stable for years. What’s changing is the rate of accumulation. Open source components per codebase grew 30% year-over-year; files per codebase grew 74%. More dependencies, more deeply nested, added at a pace that outpaces any manual review process.
License risk reached its highest recorded level: 68% of codebases contain license conflicts, up 12 percentage points from the prior year. For enterprise teams that need to ship products, license conflicts in open source dependencies aren’t a legal abstraction — they’re a release gate. A component with an incompatible copyleft license can prevent distribution of the product it’s embedded in.
The AI Audit Gap
The finding that connects these trends is the one least discussed: only 24% of organizations perform comprehensive evaluation of AI-generated code before it enters their codebase. The rest are incorporating AI-assisted output — which frequently pulls in open source packages, sometimes from poorly-maintained sources, sometimes with licenses the AI doesn’t flag — at a rate that existing security tooling wasn’t designed to track.
The risk model has changed. In traditional development, dependencies are introduced deliberately, reviewed in pull requests, and tracked in lockfiles. In AI-assisted development, a single prompt can introduce five new transitive dependencies in a code block that looks like custom logic. Software composition analysis (SCA) tools can detect this — but only if they’re scanning AI-generated output with the same coverage they’d apply to hand-written code. Most current workflows don’t make that assumption.
The So What
The 107% vulnerability growth is the number that tends to lead headlines. The 24% AI audit coverage figure is the more consequential one. Vulnerability accumulation is a downstream effect of evaluation gaps that are currently accelerating. Platform and security engineering teams that haven’t updated their SCA policies to treat AI-generated code as an explicit ingestion surface are running a year behind the problem. The tooling exists — the policy change is what’s missing.
Photo by Muhammed Ensar on Pexels
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →