IBM and Red Hat expand Lightwell to secure AI-generated code across software supply chains

IBM and Red Hat have unveiled new commercial capabilities within Lightwell, their open-source platform for establishing trustworthy software supply chains in the era of AI-generated code. The initiative targets a fundamental challenge facing modern enterprises: as artificial intelligence accelerates code creation, organizations must be able to verify the origin, integrity, and compliance of every piece of software—whether written by humans or AI systems—before it reaches production.

The problem Lightwell addresses#

Traditional security approaches focused on preventing malicious actors from injecting compromised code into build systems. Today's landscape has grown more complex. AI tools generate code at unprecedented scale and speed, autonomous workflows orchestrate entire release pipelines, and organizations rely on sprawling networks of open-source components. This expansion demands a richer form of trust: not just knowing that code is secure, but being able to prove where it came from, how it was built, and whether it has been tampered with throughout its lifecycle.

The expanded Lightwell platform integrates artifact signing, provenance generation, policy validation, and lifecycle management into a single offering rather than forcing enterprises to cobble together multiple specialized tools. This unified approach aligns with existing industry standards—Sigstore, in-toto, SLSA, and software bill of materials (SBOM) frameworks—while packaging them into a commercially supported product ready for enterprise deployment.

Verifiable trust as first-class infrastructure#

The shift represents a deeper evolution in how organizations think about security. Rather than treating verification as a final checkpoint before deployment, forward-thinking teams now embed cryptographic evidence of authenticity and compliance directly into the software itself. This means that code carries proof of its provenance—who approved it, what environment built it, which policies it satisfied—from development all the way through to production.

This approach becomes especially critical as autonomous systems enter software delivery. When AI agents generate code, modify infrastructure, or resolve production incidents on their own, organizations need mechanisms to verify which entity performed each action, under what identity, and according to which governance rules. Lightwell's expanded offerings provide those mechanisms in a form that enterprises can integrate into existing deployment pipelines.