The rapid adoption of AI coding tools has created a structural vulnerability that the U.S. National Institute of Standards and Technology formally identifies as an "algorithmic monoculture" - a condition where nearly all tools share the same underlying foundation models and training data, "Hvylya" reports, citing a War on the Rocks analysis by Markus Sandelin, AI Lead at the NATO Communications and Information Agency.

The market has moved faster than most institutional analyses have tracked. Claude Code went from four percent developer adoption to 63 percent between May 2025 and February 2026, reaching an estimated $2.5 billion in annualized revenue within ten months. OpenAI's Codex tripled its weekly active users to 1.6 million after the GPT-5.3 release. Cursor still produces roughly one billion lines of accepted code per day. GitHub Copilot maintains over 20 million all-time users.

The parallel to agriculture is structural, Sandelin argued. The Irish Potato Famine killed a million people because the entire crop was genetically identical and a single blight could destroy it all. A successful poisoning technique deployed against one of the three or four foundation models powering these tools would propagate identical vulnerabilities into every tool, every organization, and every defense system built using any of them - simultaneously.

The speed compounds the problem. Claude Code, Cursor, and Copilot generate code faster than any review process can absorb. A vulnerability introduced through a model update on Monday morning is in production code by Monday afternoon, merged by a developer who saw nothing wrong and reviewed by a tool that shares the same blind spots. A September 2025 analysis of a Fortune 50 enterprise found that teams using AI coding assistants shipped ten times more security findings alongside four times the development velocity - generating 10,000 new security vulnerabilities per month.

These tools update continuously and are themselves built using AI-assisted development. "It is not just that AI tools write code that enters defense systems," Sandelin wrote. "AI tools - increasingly built and tested by agentic AI processes - write the tools that write the code that enters defense systems. The chain has folded back on itself."

Also read: how China's defense AI experiments move faster than the Pentagon can procure.