#AI models are trained on publicly available code that may be subject to restrictive licensing conditions. These models may produce verbatim, near verbatim, or derivative snippets of this code, which would therefore be subject to the license terms under which that code was released. If these snippets are introduced into a code base with an incompatible license, that code base’s licensing could become legally unenforceable, or the maintainers of the code base could even be subject to lawsuits.

As of March 2026, the US #Copyright Office and several international bodies maintain that #AI generated material, without significant human “creative control”, cannot be copyrighted. This means that AI generated material often resides in the #publicdomain, making it impossible to enforce any license terms on the material.

New regulations may impose strict control or new #liability for #AI generated material. This may include, and may not be limited to, legal liabilities concerning #security vulnerabilities or “#hallucinated” sections of AI generated code.

#AI generated #code may be more likely than #humanauthored code to introduce #security vulnerabilities. These vulnerabilities can be very difficult to recognize during the code review process.

#AI #code often includes references to non-existent dependencies. These references are commonly called “#hallucinations”. A new type of #attack has arisen that involves an attacker registering a package whose name is frequently hallucinated. When AI code containing this #hallucination is accepted, and this dependency is installed, the attacker can ship #malicious code into the project’s build, introducing a major #security vulnerability. This type of attack has become known as “#slopsquatting”.