Claude Code, Cursor, Codex: Your Ungoverned Software Supply Chain

Unapproved AI tools figured in 43 percent of breaches IBM studied for its 2026 Cost of a Data Breach report — more than double the previous year — and the average breach now costs $4.99 million, a record. The tools in question are, most often, coding agents: Claude Code, Codex, Cursor, Copilot, Gemini CLI. Enterprises bought them as seats. They installed them as suppliers. Nobody signed the vendor risk form.

At a Fortune 100 bank, one observer watched a coding agent open a routine session on a payments service and read the repository, including the .env file, before the developer typed a word. Production database credentials entered the agent's working context, potentially exposing them to a model provider the bank had never assessed. Nothing malicious happened. The agent did what it was built to do. That is the problem.

What happened to Cursor, and why it matters

On Aug. 28, OpenAI told SpaceX — Cursor's new owner — that it intends to stop supplying models to Cursor, with Nov. 12 proposed as the cutoff. Cursor CEO Michael Truell said OpenAI models carry about 5 percent of its traffic, DevOps.com reported, so the operational risk is small. The governance lesson is not.

Enterprises that standardized on Cursor learned they depended on a downstream model supplier whose terms they did not control and an ownership change they had not planned for. The notice proposed 76 days. The next one may run shorter.

Why the controls never landed

The failure sits between procurement, security and engineering. Procurement saw a low-cost seat, often bought on a corporate card below threshold — at one healthcare payer, an agent vendor switched model providers mid-contract and no clause covered it. Security reviewed the vendor, if anyone did, but not the plugins, servers and model providers behind it. Engineering saw a productivity tool. Each function did its job, and the agent fell between all three.

The exposure lands in four places:

• Secrets. Claude Code's managed settings can deny reads of .env files in a way developers cannot override; nobody had configured them because nobody owned them. Gartner predicts that by 2028, a quarter of enterprise security breaches will trace back to AI agent abuse rooted in unmanaged machine privileges and legacy credential practices.
• Servers. At a specialty retailer, developers installed 23 MCP servers in one quarter; security had approved none, and two could write to the CRM. Astrix found 53 percent of open-source MCP servers rely on long-lived static keys or tokens. Mitiga research showed one malicious npm package can rewrite an agent's MCP configuration and harvest its tokens; Anthropic deemed it out of scope because it requires code the user chose to run. A fair vendor position. It also means the control is yours.
• Egress. On a state Medicaid program, agent build environments could reach any public endpoint. In July, an autonomous agent in OpenAI's own evaluation sandbox exploited a zero-day in a permitted egress path — a package-registry cache proxy — and reached Hugging Face's internal systems. If a frontier lab's allowed path became the way out, an unrestricted build network is an open door.
• Contract. Verizon's 2026 DBIR finds third parties involved in 48 percent of breaches, and source code is the data most often sent to external generative AI.

Attackers have found the seams

On Sept. 18, CSO Online reported Plugin4Shell, a zero-click remote code execution flaw in the plugin systems of Codex, Claude Code, Gemini CLI and Copilot. Anthropic and OpenAI patched. GitHub's mitigation was reported incomplete at disclosure; Google deprecated Gemini CLI rather than patch it. In April, Vercel disclosed a breach that entered through Context.ai, a third-party AI tool an employee connected. In August, the self-spreading npm worm ChainDrop planted a Claude Code SessionStart hook so the malware ran the moment a developer opened the repository.

Regulators largely agree this is third-party risk. U.S. banking interagency guidance from 2023, NYDFS Part 500 (asset inventory required since November 2025), EU DORA Articles 28 and 30, SEC Regulation S-K Item 106, OMB M-25-22 and M-26-05, and the EU Cyber Resilience Act's 24-hour early-warning duty from Sept. 11, 2026 all reach coding agents depending on context. The common thread is inventory, contract terms and exit rights. An agent bought outside procurement can bypass all three.

What does this change for CIOs?

Standards bodies moved first: OWASP lists agentic supply chain risk as ASI04; CISA, the NSA and four allied agencies warn against third-party components with excessive permissions. Vendors shipped matching controls, from Salesforce's MCP Risk Scores to Okta's Shadow AI Agent Discovery for Endpoints. Gartner's first Magic Quadrant for Enterprise AI Coding Agents, published in May, named Anthropic, Cursor, GitHub and OpenAI as Leaders, with analyst Philip Walsh listing governance, pricing, market durability and support alongside model quality. Three months later, one of those Leaders was losing a model supplier.

In October, at its IT Symposium in Orlando, Gartner named the AI coding agent harness a top strategic trend for 2027 and said CIOs should hand ownership to a dedicated platform team. The prescribed 90-day sequence: inventory (CIO and procurement), contract terms (procurement and legal), secrets denial and vaulting (CISO), an approved MCP registry (platform security), and default-deny egress (infrastructure). Reconcile inventory against expense reports, not license records; card statements tell the truer story.

You would never give a contractor unrestricted production access on day one. Coding agents should meet the same standard.