A security leader asked Leslie Pascual, ActiveState's Field Engineering Manager for AI and Security Solutions, a question that has stuck with her: "If AI is supposed to make us faster, why does my team feel more exposed than ever?"

In this breakdown, Leslie walks through the accountability gap that opens when a developer accepts an AI suggested package in a single keystroke. No provenance check. No policy review. And in the most acute version of the problem, the package may not exist at all until an attacker registers the hallucinated name with a malicious payload and waits.If AI tooling has been adopted in your organization and governance has not caught up, this is the conversation to have before the next CVE drop.