In physics, the three-body problem describes a system where three objects interact gravitationally in ways that are fundamentally unpredictable. You can model any two of them. The moment you add the third, the math breaks. Small changes in initial conditions produce wildly different outcomes. The system becomes chaotic.
Software security has its own three-body problem. Three forces are converging right now, and the industry is modeling each one independently while ignoring what happens when they interact.
Force one: AI is generating code with 2.74 times more vulnerabilities than human-written code, and it is being shipped at unprecedented volume.
Force two: supply chain attacks grew 1,300% in three years, and the infrastructure the internet runs on is maintained by burned-out volunteers.
Force three: the security talent pipeline is collapsing. Junior hiring is down 73%. Security teams are being cut. 88% of organizations experienced a significant incident due to skills shortages.
Each force alone is a problem with known solutions. All three at once is something this industry has never faced.
Force One: The Code Nobody Audited
46% of all code on GitHub is now AI-generated. In Java repositories, that number is 61%. This is not a projection. This is the current state of the world's largest code repository.
Veracode's 2025 report found that 45% of AI-generated code samples introduce OWASP Top 10 vulnerabilities. 86% fail XSS defense. 88% are vulnerable to log injection. 72% of Java samples fail security tests. Design-level flaws, authentication bypasses, insecure direct object references, broken session management, increased 153%.
CVEs attributed to AI-generated code jumped from 6 in January 2026 to 35 in March 2026. Security researchers estimate the real count is five to ten times higher because most AI-generated vulnerabilities are never traced back to their origin. The code just ships. Nobody flags it as AI-generated. The vulnerability exists and nobody knows why.
A Stanford randomized controlled trial found that developers using AI tools wrote less secure code while reporting higher confidence in its security. They shipped faster, felt better about it, and the code was worse. That confidence gap is the mechanism through which AI-generated vulnerabilities reach production at scale.
Pull requests per author rose 20% year-over-year. Incidents per pull request jumped 23.5%. More code. More bugs per unit of code. The math is multiplicative, not additive. And nobody is reading the diffs.
Force Two: The Supply Chain Nobody Owns
On March 12, 2025, attackers compromised a GitHub Action called tj-actions/changed-files. It was used by 23,000 repositories. The attack modified version tags to inject a payload that dumped CI/CD secrets into public workflow logs. AWS keys. GitHub personal access tokens. npm tokens. It started as a targeted attack on Coinbase and then went wide. CISA issued an alert within a week.
On September 8, 2025, an attacker phished a single npm maintainer with a fake two-factor reset email. Within hours, 18 packages were compromised, including chalk and debug, which between them have 2.6 billion weekly downloads. The malicious code intercepted cryptocurrency transactions. It was live for roughly two hours. Two hours was enough.
In December 2025, a vulnerability called React2Shell was disclosed. CVSS 10.0, the maximum severity score. An unsafe deserialization flaw in React Server Components allowed pre-authentication remote code execution via a single HTTP request. It affected Next.js 15.0.0 through 16.0.6. Nation-state actors, China-nexus groups deploying backdoors, exploited it before most teams could patch. Vercel blocked over 6 million exploit attempts.
In April 2026, Vercel itself was breached. Not through a code vulnerability. Through an AI tool. A Vercel employee had granted an AI tool called Context.ai full read access to their Google Workspace. A Context.ai employee had been infected with malware. The attackers pivoted from the compromised AI tool into the Vercel employee's account, then into Vercel's platform, then enumerated and decrypted environment variables. The stolen data was listed on BreachForums for $2 million.
454,648 malicious packages were discovered on npm in 2025 alone. That is a 75% year-over-year increase. Over 99% of all open-source malware targets npm. The first self-replicating npm worm, called Shai-Hulud, appeared and infected 500 packages before containment. Malicious open-source package threats increased 1,300% in three years.
And underneath all of this sits the template attack that showed how fragile the entire system really is. The xz Utils backdoor, disclosed in March 2024. An attacker spent two years building trust with a burned-out solo maintainer of a compression library used by virtually every Linux system. They contributed code. They earned commit access. Then they planted a backdoor. CVSS 10.0. It was caught by accident, by a developer who noticed a 500-millisecond latency increase in SSH connections. If that developer had not been paying attention, it would be in every server on the internet right now.
The software supply chain is not a chain. It is a web of dependencies maintained by people who are exhausted, underfunded, and increasingly targeted by state-level attackers with AI tools and years of patience.
Force Three: The Talent That Left and Was Never Replaced
245,953 tech workers were laid off across 783 companies in 2025. In 2026, over 100,000 more followed by May. Security teams were not spared. For the first time, budget cuts surpassed talent scarcity as the top cause of security workforce shortages. 33% of organizations cited budget as the reason security positions stay empty.
Junior developer hiring collapsed 73% year-over-year. 54% of engineering leaders plan to hire fewer juniors. The entry-level pipeline that feeds mid-level and eventually senior security engineering roles is drying up. The ISC2 pegs the global cybersecurity talent gap at 4.7 million unfilled positions, up 19% from the previous year.
95% of security teams report skills gaps. 59% call them critical or significant, up from 44% in 2024. Organizations with significant skills gaps are nearly twice as likely to suffer a material breach, and those breaches cost $1.76 million more per incident.
The companies cutting security headcount are the same companies shipping more AI-generated code. They are reducing the humans who catch vulnerabilities while increasing the code that produces them. The same CFO who approved the layoffs approved the AI tooling budget. Nobody put these two line items next to each other on a spreadsheet.
Where the Three Forces Collide
Model any two of these forces and the picture is manageable. AI-generated vulnerabilities plus strong security teams equals a solvable problem. Supply chain attacks plus experienced reviewers equals a defensible position. Talent shortages plus human-written code equals a staffing challenge, not a crisis.
All three at once is different.
AI generates code with more vulnerabilities. That code flows into the supply chain as packages, dependencies, and shared actions. The supply chain has 454,648 new malicious packages per year and maintainers who are too burned out to review what enters their repositories. The security teams who would catch the vulnerabilities and the supply chain compromises have been cut. The juniors who would have grown into security engineers were never hired.
Meanwhile, the attackers are using the same AI tools. AI-powered cyberattacks increased 72% year-over-year. AI-crafted phishing emails achieve a 54% click rate compared to 12% for human-written ones. A new attack vector called slopsquatting has emerged: attackers register the fake package names that AI coding tools hallucinate. Researchers found that 19.7% of AI-recommended package names do not exist, and 43% of those hallucinated names repeat consistently, making them predictable targets. The AI tools writing the code are directing developers to install packages that attackers have already registered.
The FBI documented 22,364 AI-related cybercrime complaints with $893 million in losses in 2025. Prompt injection, the technique where hidden instructions in data manipulate AI tools into executing unintended actions, is being compared to SQL injection in the early web. It is a fundamental architectural flaw, not a bug to be patched.
The attack surface is growing exponentially. The defense capacity is shrinking linearly. Those curves crossed sometime in 2025 and nobody marked the date.
What the Next Twelve Months Look Like
Gartner predicts that 50% of enterprise cybersecurity incident response will involve AI application incidents by 2028. They predict that 25% of enterprise generative AI applications will experience five or more security incidents per year, up from 9% in 2025. Forrester predicts that an agentic AI deployment will cause a publicly disclosed data breach in 2026.
IBM's 2025 report found that shadow AI breaches already cost $4.63 million on average, $670,000 more than standard incidents. 97% of organizations with AI-related breaches lacked proper AI access controls. Enterprises invest 17 times more in AI-powered tools than in securing the AI itself.
The Vercel breach was the preview. An AI tool with workspace access became the entry point. Not a code vulnerability. Not a phishing email. An AI tool doing exactly what it was authorized to do, being exploited through a compromise the AI tool's own security could not prevent. That pattern will repeat because every company granting AI tools access to codebases, cloud accounts, and internal documents is creating exactly the same attack surface Vercel had.
The prt-scan campaign in March and April 2026 used AI to automate GitHub Actions exploitation across 500 repositories in six weeks. That is the new pace of supply chain attacks. Not one patient attacker spending two years on xz Utils. An AI system attacking hundreds of repositories simultaneously.
Nobody Has a Model for This
The security industry models threats individually. AI code vulnerabilities are an AppSec problem. Supply chain attacks are a DevSecOps problem. Talent shortages are an HR problem. Each one has a playbook. Run SAST scans on AI code. Pin dependencies and verify signatures. Increase security headcount.
None of those playbooks account for the other two problems happening at the same time. You cannot run SAST scans effectively when the security team has been cut. You cannot verify supply chain integrity when nobody has time to audit dependencies because they are reviewing AI-generated code. You cannot increase security headcount when the junior pipeline that feeds it has been shut off.
The three-body problem in physics has no general solution. The three-body problem in security might not have one either. But physics does not let you change the initial conditions. The industry still can.
That window is closing. The developer velocity that feeds them is not slowing down. And the companies still modeling them independently are going to be the ones in the incident reports.
Top comments (0)