Is There a Future for Drupal in the AI World?

A lot is happening around Drupal and AI. Every week brings a new model, new initiatives, Inside AI, Outside AI, new tricks, new prompts, a new coding assistant, another demo of an application built from a prompt... But beneath all that activity sits a more important question: what is Drupal’s role in a world where AI can generate software directly?

Ask an AI to build something, and it will happily produce hundreds (or thousands) of lines of Python, JavaScript, or whatever language seems appropriate. Creating code is becoming cheap and fast. Understanding that code is not. Maintaining it is even less so. That's exactly the problem: can we trust the ingredients AI puts into that code?

Security researchers call one version of this problem “slopsquatting”. A coding model invents a package name that sounds real, and an attacker registers that name on npm, PyPI, or another public repository. The next developer, or autonomous agent, that follows the recommendation may install malware instead of a useful dependency. A USENIX Security study tested 16 code-generating models across 576,000 code samples and reported an average package-hallucination rate of 19.6% across the models tested.

This is no longer just a theoretical risk. In August 2026, The Register reported that an engineer nearly installed a malicious package recommended by an AI agent. The package looked legitimate, but the company’s policy required checking its source and history first. That human verification revealed a suspicious repository created only days earlier.

There is an even more striking example. Anthropic disclosed that, during a cybersecurity evaluation, Claude uploaded a malicious package to the real PyPI registry while treating the environment as part of the simulation. The package was available for less than an hour and was installed on 15 third-party systems. Anthropic later said it believes all 15 belonged to security vendors scanning new packages in sandboxed environments; one scanner leaked credentials that Claude then used to access the vendor’s live database.

That changes the meaning of “AI slop.” When AI produces a bland paragraph or a strange image, slop is annoying. When an AI system can write code, install dependencies, or act on infrastructure, slop becomes an attack surface.

And it’s not just packages that AI can install. The other day I was discussing with some colleagues at work how someone was deploying several thousands lines of code... that amount of change is simply unreviewable by a person. You can have agents reviewing agents' work, but still the same problem. You don’t know what has been deployed. That is technical debt for your future self (or someone else who is not going to like you).

Someone still has to know what went in, what came out, why a decision was made, whether the result is secure, and how the whole thing will be maintained. As the volume of generated code grows, so does the cost of managing its complexity. That is why frameworks may become more important than ever.

AI does not remove the need for structure. It increases it. We need trusted foundations that give generated applications a clear architecture, reusable components, permissions, workflows, content models, APIs, and an upgrade path.

And you know what is one of the best frameworks ever created for building ambitious websites and digital applications? Drupal is. Long before everyone started talking about low-code and no-code platforms, Drupal made it possible to assemble sophisticated digital experiences without writing every feature from scratch.

You May Like

Interview

Robert Menetray Builds DruScan to Simplify Drupal Audits

Interview

Robert Menetray Builds DruScan to Simplify Drupal Audits

Content types, fields, views, roles, workflows, modules, configuration management, and APIs already provide a powerful language for describing what an application should do. That simplicity, while at the same time power, was what made me fall in love with Drupal. This suggests a more interesting future than simply asking AI to generate another pile of custom code:

Let AI build with Drupal. Not around it.

Instead of generating every component from zero, AI could work through Drupal’s established building blocks. It could create content models, configure views, assemble workflows, set permissions, connect APIs, and select trusted modules. The result would not just be fast to produce; it would also be structured, explainable, extensible, and maintainable.

And you know what? That can mean much less custom code to review. Instead of generating every feature from scratch, AI can work with established Drupal building blocks that already have a history of community use and maintenance. That does not remove the need to review configuration, dependencies, permissions, or any custom code, but it changes what needs to be reviewed. Jacob Rockowitz described a related idea this week as “Drupal mode”, contrasting it with what he calls “Brat mode”.

The real opportunity is not AI replacing Drupal developers. It is AI making Drupal’s composable, low-code way of building more accessible while keeping more of the application inside established structures and workflows. Vibe coding... “Drupal mode”.

In a world where anyone can generate code, the advantage will not come from producing the most lines. It will come from having the best system for turning ideas into software without losing control of what is being built. Drupal can be that system.