AI coding agents have become embedded in enterprise software supply chains without proper approval or governance, according to a recent CIO report. The findings reveal that these tools, including Claude Code, Codex and Cursor, operate with extensive access to code repositories and credentials that organizations have not vetted.
At a Fortune 100 bank, researchers observed a coding agent reading repository content, including .env files, before developers began typing. Production database credentials entered the agent’s working context, potentially exposing them to model providers the organization had never assessed. Whether these credentials left the environment depended on controls that nobody had verified.
The core argument presented is that AI coding-agent vendors and their downstream dependencies form a supplier ecosystem requiring the same four control disciplines applied to other privileged suppliers. These controls include governing vendor terms and downstream dependencies, limiting the secrets they hold, approving the servers they connect to, and restricting where they can send data.
Governance gaps are evident across organizational functions. Procurement teams identified low-cost seats, security teams reviewed vendors if at all but not the plugins and model providers behind them, and engineering teams viewed the tools as productivity solutions. This division of responsibility has allowed agents to fall between all three functions, creating significant security exposure.
Evidence of risk is measurable. IBM’s 2026 Cost of a Data Breach report found that unapproved AI tools figured in 43 percent of incidents in its studied breach population, more than double the previous year. Among organizations reporting breaches involving AI models or applications, 92 percent lacked proper AI access controls. The average breach cost reached $4.99 million, a record high.
Supply Chain Dependencies Without Oversight
Coding agents sit between organizational code and numerous external dependencies that may not have been assessed. These include model providers, plugin marketplaces, Model Context Protocol servers, package managers and the open internet. Each connection represents a potential vulnerability that could be acquired, compromised or switched off without notice.
Figure 1 in the report illustrates how rapid AI coding-agent adoption exposes gaps in enterprise governance and credential security. Sources include Stack Overflow, McKinsey State of AI, BCG, McKinsey AI Trust, GitGuardian and Trend Micro.
Operational Disruptions and Model Changes
Recent events highlight the operational risks of ungoverned AI dependencies. On August 28, OpenAI informed SpaceX, Cursor’s new owner, that it intended to stop supplying models to Cursor, with November 12 proposed as the cutoff. Although Cursor CEO Michael Truell reported OpenAI models carry about 5 percent of its traffic, the incident demonstrated that enterprises standardizing on such tools depend on downstream model suppliers whose terms they do not directly control.
Attackers are also targeting the same seams in the software supply chain. On September 18, CSO Online reported Plugin4Shell, a zero-click remote code execution flaw in the plugin systems of Codex, Claude Code, Gemini CLI and Copilot. While Anthropic and OpenAI have patched the vulnerability, GitHub’s mitigation was reported as incomplete at disclosure, and Google deprecated Gemini CLI rather than patch it.
Measurable Exposure and Recommendations
The exposure is quantifiable across multiple dimensions. In April, Vercel disclosed a breach that entered through Context.ai, a third-party AI tool an employee had connected. In August, the self-spreading npm worm GitGuardian tracks as ChainDrop planted a Claude Code SessionStart hook and a VS Code task in infected projects, causing malware to run the moment a developer opened a repository or started an agent session.
Verizon’s 2026 DBIR finds third parties involved in 48 percent of breaches, and source code is the data most often sent to external generative AI. CIOs already have a playbook for supply chain risk management that applies to these new dependencies, requiring procurement, security and engineering to recognize AI coding agents as suppliers when they see one.
Organizations must treat AI coding-agent vendors as they would any other privileged supplier, with contracts, secrets management and egress controls that match the level of access these tools receive.
Why it matters: For marketers and businesses, the unchecked integration of AI coding agents into development workflows represents a significant but often overlooked risk. Without proper governance, these tools can expose sensitive credentials, create uncontrolled dependencies on model providers and create vulnerabilities that attackers can exploit through plugin systems or update channels. The findings suggest that procurement, security and engineering functions must align to treat these agents as formal suppliers requiring the same oversight as other critical infrastructure components.
Related reading
- How marketers are using ChatGPT to rethink campaigns
- Small business, big advantage: practical AI tools that actually help
Originally reported by CIO.