JFrog CEO Shlomi Ben Haim told approximately 500 software engineers today that in the age of artificial intelligence (AI) no one will soon care much about source code anymore.
Speaking at the company’s swampUP 2026 conference, Ben Haim said AI tools are now creating executable binaries directly without relying on source code that historically existed to provide a method for humans to review code.
However, in an era where AI tools are creating code that often isn’t even readable by a human application developer, the focal point for securing software supply chains is now moving to scanning application binaries, said Ben Haim. No one cares how many lines of source there are, he added.
It’s not clear to what degree DevSecOps teams might be coming to a similar conclusion, but it’s apparent that the volume of code being created using AI coding tools is overwhelming existing DevSecOps workflows. An alternative approach to application security in the AI era would be to focus more on applying AI to ensure that the executables stored in a registry such as JFrog Artifactory are actually secure. If not, the time and effort needed to update and replace the software packages used to create those binaries is becoming increasingly trivial as more AI agents are embedded into DevOps workflows.
That issue is only going to become more problematic as application developers of varying skill levels not only build more applications, but also deploy their own custom AI agents, noted Ben Haim. By 2030, 2.5 billion active agents will be completing 459 trillion actions, he noted. DevSecOps workflows that focus on the source code used to create those AI agents will simply not scale, noted Ben Haim.
Ultimately, the goal is to essentially build applications that for all intents and purposes are self-healing, with each executable being able to validate that it is cryptographically secure in a way that doesn’t require a human to validate. Additionally, there will inevitably be more focus on how secure the prompts and specification frameworks used to create executables are to help achieve that goal.
Exactly how the role of DevSecOps teams will evolve as the focus shifts more toward securing binaries is unclear, but some of the fundamental assumptions made about how to secure software in the age of AI will likely need to change. The challenge is that agentic engineering is still a work in progress, so there is not yet a well-defined set of best practices for securing software supply chains in the AI era that has been widely embraced.
Hopefully, there will come a day when applications are inherently more secure as AI technologies are used to not only create them but also secure them. In the meantime, however, DevSecOps teams may have their work cut out for them as the rate at which vulnerabilities in both existing and new applications continues to exponentially increase. As troubling as that may be, however, it does at the very least create a greater sense of urgency around application security that arguably has been missing for far too long.
