AI Exposes CVEs Faster Than Maintainers Can Patch: Dev Says AI Does More Harm Than Good
_jaydeepkarale · x · 2026-10-23
Developer Jaydeep Karale quotes a thread on software supply chain attacks to push back on "coding is dead" takes.
- The quoted post describes how modern AI app stacks (LangChain, Python packages, AWS, GitHub Actions) rely on trusted-but-unaudited dependencies; in 2026 attackers compromised the Trivy security scanner in LiteLLM's CI pipeline in March, stole publishing credentials, and pushed malicious versions.
- Karale's argument: AI is being used to surface CVEs at a pace maintainers can't match, because shipping new versions requires human coordination, judgment, and expertise — not just code generation.
- His conclusion: AI tools are currently doing more harm than good to the world.
More from coding & agent
- OpenDS-World launches live-web deep search benchmark, frontier models trail humans by large margins — Xiaomin Yu · 2026-10-23
- Naive RAG beats complex agentic memory on 6 of 7 benchmarks, XJTU study finds — XianJiaotongUniversity · 2026-10-23
- AI Assistant Offers to Draft Your Replies and Track Friends Daily — "Sounds Like Hell" — cnakazawa · 2026-10-23
- Dev uses Grok Build to model 140 types of network effects into a Moog-style synthesizer gallery — seanmcdonaldxyz · 2026-10-23
- Why Zig's explicit allocators make it a great fit for building databases — arpit_bhayani · 2026-10-23
- How to build a Company OS with Claude Code and Slack, after 11 days of building — aakashgupta · 2026-10-23