Security researcher: AI code rewrites may push companies to drop OSS dependencies
chrisrohlf · x · 2026-10-25
Chris Rohlf outlines a possible outcome of the "vulnpocalypse": companies may conclude that OSS dependencies cost too much in risk, dollars, and engineering hours. Transitive dependencies bring supply-chain risk that likely outweighs the value of a few hundred lines of code, and the cost of having AI rewrite just the needed fraction as first-party code will eventually beat the ongoing cost of dependency management. Good for security, bad for the OSS ecosystem.
More from AGI Musings
- AI moat debate: moats shift up a level of abstraction, models themselves aren't the moat — secemp9 · 2026-10-25
- Michael Levin: Fire Engineers Who Don't Believe Machines Have Goals — JensHonack · 2026-10-25
- "Why does AI pretend to be human? To order me stuff off Amazon" — chrisalbon · 2026-10-25
- Two ways people react when AGI feels near: resign to pleasure or contribute furiously — danfaggella · 2026-10-25
- Ruff creator: LLMs made my prompting so lazy it's leaking into my Slack messages — charliermarsh · 2026-10-25
- New paper uses 288M job postings to measure where AI raises the value of work it can't do — soumitrashukla9 · 2026-10-25