AI-generated software is forcing yet another platform rethink

At PlatformCon London, platform engineers and engineering leaders expressed concerns about using AI to write code and whether their security systems are adequate for handling AI-generated code. Liz Rice, chief open source officer at Isovalent, highlighted that finding vulnerabilities in AI-generated code is becoming less relevant due to its non-deterministic nature, making guardrails around system capabilities increasingly important.

Panelist Joe Baguley, CTO of EMEA at Broadcom, suggested that "there is no such thing as a zero-day anymore" and emphasized the importance of Software Bills of Materials (SBOMs) in understanding dependencies within products. The rise of AI-written code also brings about the concept of "Shadow AI," which can introduce additional security risks.

To address this, AI bills of materials (AI-BOMs) are being proposed to track all non-deterministic components, such as model weights, training datasets, and third-party APIs, to prevent supply chain gaps, data poisoning, and regulatory non-compliance. With more individuals in a company potentially able to write code that creates security risks, it is essential to onboard everyone to the internal developer platform.

However, this may lead to a more traditional command-and-control IT platform approach. Additionally, runtime shields, often based on eBPF, are suggested as a solution to protect systems against software vulnerabilities quickly, as they can safeguard file systems, prevent privilege escalations, and monitor network access.