Ghosts in the machine: AI malware shows why it is time to extend Zero Trust to code

image via TechRadar

August 18, 2026, 10:41 AM

• •The piece says AI systems are increasingly writing production code, citing Anthropic's report that more than 80% of merged code in its production codebase is authored by Claude.
• •It argues AI can help attackers automate reconnaissance, vulnerability discovery, exploit generation and payload adaptation at machine speed.
• •The author says software supply-chain measures such as SBOMs, signing and provenance validate origin and composition but not runtime behavior.
• •The proposed response is 'Zero Trust for Code,' where software execution is evaluated against policy before it runs.
• •The article recommends mapping all paths by which code enters or executes in an environment, including repositories, packages, containers, scripts, attachments and AI-driven automation tools.

The article argues that AI is accelerating both legitimate software development and malicious code generation, shrinking the time available for human review. It says attackers can use AI to produce, adapt and deploy payloads quickly, making traditional indicators such as signatures and reputation less reliable. The author contends that existing supply-chain checks like SBOMs, signing and provenance do not show what software will actually do at runtime. He argues enterprises should apply Zero Trust principles to code execution by evaluating expected behavior against policy before software is allowed to run.

Read original article