Security Takes Backseat as Developers Rapidly Adopt AI Components, Study Finds

Researchers have uncovered a troubling pattern in how the software industry is integrating AI into production systems: security considerations are largely absent from the decision-making process, leaving applications exposed to significant supply chain risks.

Study methodology and findings#

The analysis, based on semi-structured interviews with 22 software developers, architects, and AI practitioners across multiple organizations, reveals the gap between how the industry currently treats AI adoption and how it ought to. According to the researchers, practitioners overwhelmingly prioritize functional criteria—performance benchmarks, accuracy metrics, cost factors, and specific capabilities like tool calling or multimodal support—when selecting Large Language Models (LLMs) for their systems.

Security, by contrast, rarely enters the evaluation rubric at all.

The repeated mistakes of history#

The pattern echoes an earlier era of software development. When dependency management first emerged, the industry prioritized rapid reuse and immediate availability over provenance and security validation. Those early decisions proved costly. Today, as AI components proliferate through modern codebases, the same pressures are driving practitioners to overlook hard-won lessons.

The research identifies persistent blind spots throughout the AI integration lifecycle, from model selection through deployment. Developers appear unaware of—or indifferent to—threats including malicious components, data leakage, and unintended model behaviors that could compromise an entire application.

Path forward#

The researchers call for a shift toward security-by-design, urging AI adopters, model providers, and the research community to embed security evaluation into component selection from the outset and maintain that rigor across the software development lifecycle. Without intervention, the industry risks repeating expensive mistakes in an even more critical domain.

Read the full study on arXiv: "From Adoption to Deployment: A Qualitative Study on AI Integration in Software Development Practice"