Attackers turn AI coding tools and agent skills into supply-chain entry points
· Source: itwire.com
In short
Mandiant's AI Risk and Resilience report warns that AI coding assistants, agent skills and open-source model components are becoming prime targets for cybercriminals seeking to breach software supply chains. In one case, a hijacked AI coding assistant recommended a poisoned package that installed an information stealer, harvested GitHub OAuth tokens and spread the Shai-Hulud worm across roughly 100 internal repositories. Mandiant urges organisations to treat AI assistants, plugins and MCP servers as privileged development components, with signing, verification, strict reviews and cryptographic dependency checks.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 38, 2026: AI Moves Closer to Supply Chain Decisions, but Data and Returns Still Lag
Tags: cybersecurity, supply chain, AI agents, malware, DevSecOps