socket.devtalkSocket: How AI Agents Expand the Software Supply Chain Attack Surface
Socket founder Feross Aboukhadijeh's AI Council 2026 talk examines how coding agents that autonomously select dependencies, connect to MCP servers, install skills, and execute code with developer credentials are reshaping the software supply chain threat model. He walks through 2026 attacks against Axios, TanStack, and Trivy involving compromised maintainers, malicious transitive dependencies, and prompt injection, arguing existing security tooling assumes human trust decisions that no longer hold at machine speed.
TL;DR Socket CEO Feross Aboukhadijeh's talk on how AI coding agents (dependency selection, MCP servers, IDE extensions) widen the supply chain attack surface, illustrated by 2026 Axios/TanStack/Trivy incidents.
Organisations named here
- Feross Aboukhadijeh
- Trivy
Technologies named here
- axios
- AI agent skills
- tanstack
- Trivy
- IDE extensions
- Model Context Protocol
- Socket
Techniques named here
- Compromised maintainers
- Malicious transitive dependencies
- Prompt Injection
- Abuse of trusted development tools
Related in Supply Chain
