AI-assisted coding speeds up implementation, testing and documentation, but it also creates new attack surfaces that conventional processes often miss. These include vulnerabilities in generated code, supply-chain attacks through hallucinated packages (slopsquatting), data poisoning from compromised training repositories, and prompt injection in agent-based development environments. The talk proposes a compact, risk-based framework for security-critical development. It starts with a clearly defined intended use for each AI tool and identifies the activities, assets and components affected. AI-specific attack vectors are added to threat modelling and supply-chain analysis. Generated code goes through structured verification: security analysis, dependency checks, human review and traceabilit ...