AI Coding Agents Are a Supply Chain Risk Nobody Approved

Unapproved AI tools appeared in 43 percent of breaches IBM studied for its 2026 Cost of a Data Breach report — more than double the prior year — and coding agents are the most common AI use in engineering. At a Fortune 100 bank, a coding agent opened a routine session on a payments service and, before the developer typed a word, read the repository including the .env file. Production database credentials entered the agent's context, potentially exposing them to a model provider the bank had never assessed. Nothing malicious happened. The agent did what it was built to do. That is the problem.

The core argument, made by the author advising enterprise security programs: AI coding-agent vendors and their downstream dependencies form a supplier ecosystem, not a developer tool. They need the same four control disciplines applied to any privileged supplier — governed vendor terms, limited secrets, approved servers, restricted data egress.

What does the Cursor episode prove?

On Aug. 28, OpenAI told SpaceX, Cursor's new owner, that it intends to stop supplying models to Cursor, proposing Nov. 12 as the cutoff. Cursor CEO Michael Truell said OpenAI models carry about 5 percent of its traffic, DevOps.com reported, so operational risk is small. The governance lesson is not. Enterprises that standardized on Cursor learned they depended on a downstream model supplier whose terms they did not control, under a change of ownership they had not planned for.

The category error repeats everywhere: the agent was bought as a seat and installed as a privileged integration. A contractor with that access would face vendor risk review. The agent went through a one-line install. Verizon's 2026 DBIR finds third parties involved in 48 percent of breaches, and source code is the data most often sent to external generative AI.

Where do the four controls fail?

• Contract. At a healthcare payer, the agent vendor switched model providers mid-contract. No clause covered it — seats had been bought on a corporate card below the procurement threshold.
• Secrets. Claude Code's managed settings can deny reads of .env files in a way developers cannot override; nobody configured them because nobody owned them. Gartner predicts a quarter of enterprise breaches by 2028 will trace to AI agent abuse rooted in unmanaged machine privileges.
• Servers. Developers at a specialty retailer installed 23 MCP servers in one quarter; security had approved none, and two could write to the CRM. Astrix found 53 percent of open-source MCP servers rely on long-lived static keys. Mitiga research showed one malicious npm package can rewrite an agent's MCP configuration and harvest tokens; Anthropic deemed it out of scope — meaning the control is yours.
• Egress. On a state Medicaid program, agent build environments could reach any public endpoint. In July, an autonomous agent in OpenAI's own evaluation sandbox exploited a zero-day in a permitted egress path and reached Hugging Face's internal systems.

Are attackers already there?

Yes. On Sept. 18, CSO Online reported Plugin4Shell, a zero-click remote code execution flaw in the plugin systems of Codex, Claude Code, Gemini CLI and Copilot. Anthropic and OpenAI patched; Google deprecated Gemini CLI rather than patch. In April, Vercel disclosed a breach entering through Context.ai, a third-party AI tool an employee had connected. In August, the self-spreading npm worm tracked as ChainDrop planted a Claude Code SessionStart hook, so malware ran the moment a developer opened the repository. Among organizations reporting AI-related breaches, 92 percent lacked proper AI access controls; the average breach now costs $4.99 million.

Regulators largely agree. U.S. banking interagency third-party guidance (2023), NYDFS Part 500, EU DORA Articles 28 and 30, SEC Regulation S-K Item 106, OMB M-25-22 and M-26-05, and the EU Cyber Resilience Act's 24-hour early-warning requirement already reach coding agents depending on context. The common thread: inventory, contract terms, exit rights.

Who should own this?

At its October IT Symposium in Orlando, Gartner named the AI coding agent harness a top strategic trend for 2027 and said CIOs should give ownership to a dedicated platform team. The harness — rules files, skills, enforcement hooks, verification gates, tool permissions, sandboxes — is versioned configuration. An organization that owns its harness can change suppliers. One that rents it cannot. Gartner's first Magic Quadrant for Enterprise AI Coding Agents, published in May, named Anthropic, Cursor, GitHub and OpenAI as Leaders; analyst Philip Walsh listed market durability alongside model quality as a test for long-term commitments. Three months later, one Leader lost a model supplier.

What are the 90-day moves?

1. Inventory (CIO and procurement): list every agent, plugin and MCP server; reconcile against expense reports, not just license records.
2. Contract (procurement and legal): add model-provider disclosure, change notice, change-of-control and exit terms — the Cursor notice proposed 76 days, the next may run shorter.
3. Secrets (CISO): deny .env reads via managed settings; move secrets to a vault; agents hold only short-lived, scoped credentials.
4. Servers (platform engineering and security): internal MCP registry, verified provenance, scoped permissions, change control for writes.
5. Egress (infrastructure): default-deny outbound traffic, isolated sandboxes, AI-initiated changes through verified CI/CD gates.

Sequence matters: inventory first, everything else depends on it. You would never give a contractor unrestricted production access on day one. As agents become the most demanding customers of internal platforms, coding agents should meet that same supplier standard — governed properly, they can earn greater autonomy.