---
title: "Comment by Correlic on \"AI-Assisted Development Has a Supply Chain Problem\" | Hashnode"
description: "This is an important intersection that doesn't get enough attention. AI coding assistants are effectively automating the trust decisions that developers used to"
url: "https://hashnode.com/posts/ai-assisted-development-has-a-supply-chain-problem/69d7f382fa7251682ee30a8d/comment/69d9901cc8e5007ddb1ab8d7"
---

[Discussion](https://hashnode.com/posts/ai-assisted-development-has-a-supply-chain-problem/69d7f382fa7251682ee30a8d)

Comment [AI-Assisted Development Has a Supply Chain Problem](https://hashnode.com/posts/ai-assisted-development-has-a-supply-chain-problem/69d7f382fa7251682ee30a8d)

[Correlic](https://hashnode.com/@correlic)

[Apr 11](https://hashnode.com/posts/ai-assisted-development-has-a-supply-chain-problem/69d7f382fa7251682ee30a8d/comment/69d9901cc8e5007ddb1ab8d7)

This is an important intersection that doesn't get enough attention. AI coding assistants are effectively automating the trust decisions that developers used to make manually — which package to use, which version, whether a dependency is actively maintained. When the model suggests a dependency it saw in training data, there's no guarantee that package hasn't been typosquatted or abandoned since. The compounding risk is that AI-generated code tends to pull in more dependencies than hand-written code because the model optimizes for working solutions, not minimal dependency trees. Every additional package is another node in your attack surface graph. Tools like lockfile auditing and SBOM generation help, but the real gap is at the point of code generation itself — we need runtime and build-time checks that can flag suspicious or unexpected dependency introductions before they ever land in a PR.

[Ramprakash](https://hashnode.com/@ramprakashvel)

[Apr 12](https://hashnode.com/posts/ai-assisted-development-has-a-supply-chain-problem/69d7f382fa7251682ee30a8d/comment/69d9901cc8e5007ddb1ab8d7#reply-69dba438aadf1107e2e79cab)

Yes I think [hashnode.com/posts/ai-assisted-development-has-a-…](https://hashnode.com/posts/ai-assisted-development-has-a-supply-chain-problem/69d7f382fa7251682ee30a8d/comment/69d90f45c8e5007ddbb5603f#reply-69dba331aadf1107e2e6c2e4) approach would be better suited for this purpose.