Hidden Dependencies in AI-Generated Code
How direct, transitive, and runtime-expanded dependencies can make the true dependency surface of AI-generated software much larger than its visible imports suggest, and why SBOM generation is essential.
Primary question: Why can the dependency surface of AI-generated software be much larger than its visible imports?
Direct answer
The visible imports in AI-generated code represent only the direct dependencies; the actual dependency surface includes transitive and runtime-expanded dependencies that may not be captured by static source inspection
The visible imports in AI-generated code represent only the direct dependencies; the actual dependency surface includes transitive dependencies and runtime-expanded dependencies that may not be captured by static source inspection and require automated discovery through SBOM generation and SCA analysis. [hidden-deps-study][nist-sbom-framework]
AI-generated code can introduce transitive dependencies that the developer is not aware of, because the AI tool may suggest a package that depends on other packages not visible in the generated code. [hidden-deps-study]
SBOM generation is essential for understanding the true dependency surface of AI-generated software, because manual inspection of source code cannot reliably identify transitive and runtime-expanded dependencies. [nist-sbom-framework]
Definitions
Direct dependency
A package or library that is explicitly declared in the project's dependency manifests and imported by the application source code.
Transitive dependency
A package or library that is not directly imported by the application but is required by a direct dependency. Transitive dependencies form a dependency graph that can extend several levels deep.
Runtime dependency expansion
The phenomenon where additional dependencies are loaded or activated at runtime through dynamic imports, configuration-driven loading, or framework-level dependency injection, beyond what is visible in static source code analysis.
Hidden dependency
A dependency that is used by the application but is not obvious from source code inspection alone, including transitive dependencies, dynamically loaded packages, and framework-managed dependencies.
The engineering problem
AI-generated code can import packages that pull in transitive dependencies, expanding the application's dependency surface beyond what is visible in the generated source code. The developer may only see the direct import, not the resolved dependency graph. [hidden-deps-study]
One empirical study of LLM-based coding agents found that generated code frequently references dependencies with missing or incorrect versions, and that transitive dependencies are often not explicitly declared in generated code. [hidden-deps-study]
Runtime dependency expansion — through dynamic imports, configuration-driven loading, or framework-level dependency injection — can introduce additional dependencies that are not visible during static code review of AI-generated code. [nist-sbom-framework]
Without automated SBOM generation, organizations may underestimate the true dependency surface of AI-generated applications, leaving them exposed to vulnerabilities in transitive dependencies that are not reviewed during code inspection. [nist-sbom-framework]
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Dependency discovery
SBOM generation- Artifact
- Dependency manifests, project files, installed component directories, and transitive dependency metadata.
- Risk
- Incomplete dependency inventory that misses transitive and runtime-expanded dependencies in AI-generated applications.
- Output
- An SBOM documenting the direct and transitive dependencies discovered by the selected resolution and analysis methods, enabling vulnerability assessment and supply-chain evaluation.
Evidence: DerScanner software composition analysis documentationNIST SP 800-161 Rev. 1 — Supply Chain Risk Management Framework
Dependency graph analysis
Transitive dependency analysis- Artifact
- The resolved dependency graph produced by SBOM generation, including discovered transitive dependency levels.
- Risk
- Undetected vulnerabilities in transitive dependencies that are not directly imported by the application but are used by direct dependencies.
- Output
- A dependency graph showing the direct and transitive dependencies discovered by the selected resolution and analysis methods, with their versions and relationships.
Evidence: DerScanner software composition analysis documentation
Verification workflow
- Generate or modify code with an AI coding tool.
- Run SBOM generation to discover the direct and transitive dependencies in the AI-generated application.
- Analyze the dependency graph to identify transitive dependencies that were not explicitly declared by the developer.
- Cross-reference the discovered dependency inventory against known vulnerability databases to identify vulnerabilities in transitive dependencies.
- Evaluate runtime dependencies by analyzing dynamic imports, configuration files, and framework-level dependency injection.
- Integrate SBOM generation into the build process to continuously monitor the discovered dependency surface of AI-generated applications.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SBOM generation and SCA analysis capabilities that discover the direct and transitive dependencies in AI-generated applications.
DerScanner generates SBOMs that document the discovered dependencies, including transitive dependencies, for AI-generated applications. [derscanner-sca]
Limits of verification
- SBOM completeness depends on the quality of dependency manifests and source-file resolution.
- Static SBOM generation may not capture runtime dependency expansion caused by dynamic imports, configuration-driven loading, or framework-level dependency injection.
- Dynamic imports and framework-level dependency injection may introduce dependencies that are difficult to discover statically.
- Production acceptance remains an organizational engineering decision.
Related knowledge
Dependency Security for AI-Generated Code
Umbrella page covering the broader dependency security analysis model for AI-generated applications
Relationship: related-toSBOM vs SCA vs Hybrid Analysis
SBOM generation as the first layer of dependency discovery
Relationship: related-toAI-Generated Code Is Not Reproducible (Yet)
Empirical study on dependency gaps in LLM-based coding agents
Relationship: related-toDerScanner
Product line providing SBOM generation and SCA analysis capabilities
Relationship: related-toCanonical terms used: Hidden dependencies; Transitive dependencies; Runtime dependency expansion; SBOM generation.
Evidence and references
- NIST SP 800-161 Rev. 1 — Supply Chain Risk Management FrameworkNIST SP 800-161 Rev. 1 provides supply chain risk management guidance for organizations. It recommends maintaining SBOMs as a practice within supply chain risk management to enable vulnerability assessment and incident response, and discusses documenting components including transitive dependencies.
nist-sbom-framework - DerScanner software composition analysis documentationDerScanner SCA identifies component vulnerabilities, dependencies, software supply chain risks, and license risks. DerScanner generates SBOMs documenting the dependencies discovered by the selected resolution and analysis methods.
derscanner-sca
Discover hidden dependencies