In spring 2026, a self-replicating worm called Mini Shai-Hulud tore through the npm (Node Package Manager) and PyPI (Python Package Index) ecosystems, compromising roughly 170 packages across hundreds of malicious versions, with a historical download base exceeding 518 million, according to research from the Cloud Security Alliance.
In other words, the trust layer itself became part of the attack surface.
The attack was not just another dependency compromise. It abused trusted publishing and provenance controls designed to verify software integrity, and it planted persistence in AI coding-agent configuration files that could survive ordinary package cleanup. In other words, the trust layer itself became part of the attack surface.
That is the real warning for businesses adopting AI: the risk is no longer theoretical, and it is moving faster than governance can contain unless guardrails are already in place.
Why AI Risk Outruns Governance
Despite the scale and complexity of AI risk, the hardest part is not purely technical. It is behavioral. Urgency, convenience, and incentives often move faster than policy, process, and common sense.
The C-suite wants AI now. Board pressure is real, and not embracing AI has become a career-limiting move. For an employee on a tight deadline, struggling to get a new agent or integration tool to work, caution, governance, and controls can quickly become obstacles to work around rather than guardrails designed to protect the company.
The privacy paradox is real. People express genuine concern about privacy but actively sacrifice it for convenience, speed, or utility. Workers who agree that protecting corporate data is vital may still copy proprietary code or customer lists into free, unvetted AI tools to meet tight deadlines. Attitude and behavior still live in separate rooms.
Citizen coders are the new internal attack surface. Non-technical employees are now building custom software, agents, and automation scripts with AI. Their intent is not malicious, but they often lack fundamental programming and security training. As a result, they can introduce vulnerabilities directly into the corporate environment without ever knowing it.
You cannot train your way out of human behavior alone. You design around it, with governance that sets the rules and technical controls that enforce them.
The Battle Plan: Two Layers, Both Non-Negotiable
Skip either layer and the result is not a defense. It is a gap waiting to be exploited.
To defend against today’s dynamic and fluid AI threats, enterprises need more than reactive defense. They need governance and technical controls working together, each reinforcing the other: policies that define what is allowed, and guardrails that enforce those decisions in real time. Skip either layer and the result is not a defense. It is a gap waiting to be exploited.
Six Governance Policies. No Exceptions Without Approval.
These policies decide which AI tools may be used, what risks must be controlled, and when approval is required.
- Enterprise versions only. Free or personal accounts must not touch corporate data or systems. No personal logins, ever.
- Prohibit unsanctioned local AI coding agents in production environments. AI tools that can access the file system, shell, repositories, or secrets require explicit approval, isolation, logging, and least-privilege controls.
- A preapproved AI software list. Every tool must be reviewed and approved jointly by IT, Cyber, and Legal. If a tool is not approved, user access is not permitted. The review must include the business case, intended use, data access, integrations, and risk profile.
- APIs managed by IT. APIs are not managed by procurement or individual business units. They are set up, configured, monitored, and managed by IT. Keys are never stored in plaintext; they reside in a secure vault, and rotation is a recurring calendar event, not a someday task.
- Limited integrations and connectors. Treat every connector as an exfiltration path, because it is. Approve narrowly only after Cyber, IT, and Legal review. Review quarterly and revoke aggressively.
- Mandatory change management and SDLC. With less technically savvy users now creating code, agents, and automations, development must occur in a sandbox. All code, workflows, agents, and integrations must go through standard reviews, approvals, testing, documentation, and change management before anything reaches production.
Six Technical Controls. AI Failures Stay in the Lab.
These technical controls are the line between AI productivity and an uncontrolled blast radius.
- An off-network sandbox. A physically separate workspace for AI development and coding. When something breaks, and it will, it breaks in the sandbox, not the headlines.
- A separate Microsoft tenant. Complete isolation from production: replica virtual machines, datasets, pipelines, system accounts, and user accounts. Nothing crosses the boundary into production systems.
- Azure Virtual Desktops. Build the virtual desktops in the new tenant from a golden image, keep them under continuous cyber monitoring, and make them disposable the moment they are compromised.
- Developer service accounts. Give AI coding tools their own scoped, auditable credentials. Least privilege, by default, so nothing operates with more reach than its task requires.
- AI coding agents controlled through version-controlled configuration. Permissions should live in configuration files under source control, governing what each tool may execute and reducing the chance that malicious activity slips through unnoticed. Recent AI-agent attacks have abused this same configuration layer for persistence, so treat those files like any other privileged code: locked down, monitored, and reviewed when they change.
- AI prompt and software execution controls. Use endpoint, browser, DLP, CASB/SSE, and developer-platform controls to block unsanctioned AI tools, prevent secrets from being pasted or uploaded, restrict risky code execution, and alert on attempts to bypass policy.
When Adoption Outruns Control
The software supply chain is being poisoned faster than anyone can review a dependency.
Three forces are colliding. Boards and senior management are demanding immediate AI adoption. The software supply chain is being poisoned faster than anyone can review a dependency. Employees are pasting data and secrets into free tools at the speed of a chat message. That mismatch in tempo is the risk.
The threat moves faster and mutates more often than traditional defense can absorb. Detection, patching, and training are essential, but they are not fast enough on their own. Reactive controls lose to a threat that can spread, adapt, and reappear before your next incident-response call is scheduled.
The answer is not faster reaction. It is reducing the target before the attack begins. Deny the connector. Block the free tool. Scope down the credential. Isolate the citizen-coder workload. Each decision shrinks the blast radius before exposure becomes an incident.
The speed of AI adoption may become the speed of your next breach. The only variable you control is how much attack surface you remove before adoption outruns control. 
Sandy Jacolow
Leave a Comment