Indian Developers Don’t Trust AI Code. This GCC Wants to Change That

LLMs or AI tools may be writing more code now than ever, but Indian developers are still not ready to trust it. Engineering teams in India now spend 51% of their time reviewing and hardening AI-generated code, according to findings from JFrog’s upcoming ‘Software Supply Chain State of the Union’ report. 

The Israel-based software development company, with a global capability centre (GCC) in Bengaluru, reports that 53% of engineers treat AI-generated code only as a starting point, reviewing everything before deployment, piling on validation work.

For companies building software, the challenge is no longer only about speed. It is about trust.

“How do you build trust with the AI services that are happening?” wonders Prasanna Raghavendra, Senior Director of R&D at JFrog, in an interview with AIM. “It’s a double-edged sword, no doubt about that.”

The New Problem

For years, developer tools have helped teams write software faster. AI coding assistants pushed that into overdrive. Yet the latest bottleneck appears elsewhere when software supply chains are growing harder to secure. 

JFrog found 495 malicious AI models in public registries, while 65% of Indian organisations lack malicious package detection, and 71% do not use container security, the highest share globally.

“There’s no doubt” that teams are seeing productivity gains, Raghavendra says. But the bigger concern is ensuring developers do not “inadvertently inject something spurious, you know, something that can hurt my customer or leak my customer data”.

JFrog’s observations on India reflect this tension. “We use AI to generate code, but 40–45% of the time we are validating code. So the trust of AI-generated code is very weak, and you’re losing the productivity gain as well.”

AI has also heightened software security concerns. JFrog’s report found that 58% of all new software packages in 2025 came from Hugging Face, making model registries one of the largest inputs into software supply chains. Unlike traditional packages, AI models can contain malicious payloads or unexpected behaviours.

All that sits at the centre of the software supply chain. In simple terms, modern software depends on thousands of external packages, libraries, and tools. Developers rarely build applications from scratch. Instead, they pull in components from many sources and stitch them together.

“Code doesn’t run by itself,” Raghavendra quips. 

JFrog’s technology stores and manages those dependencies. Its core product, Artifactory, acts as a repository for binaries, or packaged pieces of software needed to build applications. It also scans packages for vulnerabilities, applies compliance checks, and governs AI models within the same workflow.

Software Pipeline from Bengaluru

That work is not happening only in Israel. The company’s Bengaluru centre, built through acquisitions, now owns parts of core product development and engineering. According to Raghavendra, around 30% of the work on artefact storage happens in India, alongside AI-related engineering efforts.

Unlike many GCCs that operate as engineering back offices, JFrog says India also has product ownership responsibilities.

“We wanted to avoid the trap and make sure this group is not just a cost center, but it’s a value center,” Raghavendra notes. JFrog’s product managers and product directors sit in India and define priorities alongside global leadership.

The India team supports package ecosystems used worldwide. Technologies such as the open-source operating system Debian and iOS-based package manager CocoaPods are managed here. “Whatever is built out of here, you are the owner of that for scale, for issues, etc,” he said.

The India unit currently employs over 300 people and also plays a role in business continuity planning as geopolitical tensions affect operations in Israel.

The Race Between Speed and Trust

Raghavendra argues that companies now need governance systems for AI itself.

“What we believe is, a model is nothing but another form of binary,” he says. That means organisations need metadata, validation, and audit trails for models, prompts, and outputs, much as they do for traditional software packages.

For now, companies appear caught between pressure to adopt AI and the need to secure it. Leadership teams may believe they have visibility into AI governance, but engineers remain cautious. 

Raghavendra believes software teams will eventually solve this through what he calls “every ops”, where governance, security and development move together rather than operating separately.

Until then, India’s developers may continue to trust AI enough to write code, but not enough to ship it unchecked.