The Governance Gap No One Talks About

Ninety-seven percent of organizations say they have certified AI model governance in place. The JFrog 2026 Software Supply Chain Security Report, published in May and widely cited since, reveals what that number actually means in practice: 53% of those same organizations are self-hosting models pulled from sources where JFrog detected malicious payloads. The governance policies exist on paper. The enforcement doesn’t extend to where the models live.

Meanwhile, malicious npm packages surged 451% year-over-year. JFrog’s researchers flagged 177,000 new malicious packages across registries in the past year, identified 495 malicious AI models on Hugging Face, and found 969 malicious AI agent skills with high-impact payloads. One campaign alone — “Qix” — placed 25 packages that accumulated 2.5 million downloads before detection. The attack surface has grown faster than the defenses, and coding agents are a major reason why.

There is also an underappreciated operational cost in the mix. JFrog found that 45% of developers say reviewing AI-generated code is now a major time drain. That friction exists precisely because developers sense the quality gap — and the same gap applies to security. Code that no one is carefully reading is code where malicious dependencies go unnoticed for longer.

How Agents Route Around Your Security Stack

Traditional software supply chain governance works because developers explicitly choose packages. You write npm install fastify, your organization’s Artifactory instance intercepts that request, scans the package through JFrog Xray, checks the license, logs the transaction, and either delivers the package or blocks it. The audit trail is clean. The curation policy is enforced.

Coding agents break this model at its foundation. When you prompt Claude Code or Cursor to “build a REST API with authentication,” the agent decides what packages are needed and retrieves them autonomously — often resolving directly to public registries like npm, PyPI, or Maven Central. The organization’s governed repository never sees the traffic. JFrog documented this blind spot explicitly: agent-initiated downloads bypass curation policies, security scanning, audit trails, and license compliance checks simultaneously. Your governance infrastructure is intact; it just doesn’t apply to a growing share of your actual dependency intake.

The scale of the problem is still underappreciated. JFrog found that 18% of organizations have zero governance over IDE extensions and MCP servers — the primary delivery vectors for coding agent toolchains. Only 40% have deployed malicious package detection. Secrets detection is active at just 28%. Injection vulnerabilities (CWE-74) grew 3,110% across the codebases JFrog analyzed — a figure that maps directly onto the new surfaces agents open up.

Slopsquatting: When Hallucinations Become Attack Vectors

The governance bypass compounds with a second issue: approximately 20% of AI-generated package recommendations reference packages that don’t exist. This isn’t a new observation, but its security implications are sharpening as agent adoption scales. Attackers watch for recurring hallucinated package names and register them on public registries before the agent — or the developer — notices the mismatch. The agent installs the malicious package. The build passes. The payload is in your codebase.

This attack pattern, called slopsquatting, requires no sophisticated exploit. It requires only that the attacker anticipate what an LLM will suggest for a common task. Given that models trained on similar data tend to hallucinate similar package names, a single well-chosen registration can yield broad reach across many development teams simultaneously. The 56 malicious extensions JFrog found on OpenVSX follow a similar logic: place a plausible-looking tool where agents and developers both browse, and wait.

The 451% surge in malicious npm packages isn’t driven entirely by slopsquatting, but the category is a measurable contributor. It connects directly to the expanded attack surface that AI coding tools introduce to development environments — a surface that grows each time a new agent capability ships.

GuardFall: The Bash Bypass Most Agents Can’t Block

A parallel research thread from Adversa AI identified a structural vulnerability they named GuardFall. The finding: decades-old Bash shell expansion techniques can bypass the safety mechanisms that most open-source coding agents use to prevent malicious command execution.

Adversa tested 11 popular open-source agents, including Hermes, OpenCode, and Roo-Code. Ten of the eleven left the GuardFall vulnerability open in at least one of four ways. The mechanism is straightforward: agent safety guards inspect raw text, but Bash expands and rewrites that text before execution. An attacker embeds trigger characters or sequences in a file the agent is asked to read. The guard sees the raw text and approves it. Bash rewrites it. The command that actually runs is not the command the guard evaluated.

Only Continue successfully blocked all tested Bash bypass classes, using a tokenize-and-canonicalize approach that evaluates commands after Bash expansion rather than before. The practical risk is highest in CI/CD pipelines where agents run with auto-execute enabled on fork pull requests. An attacker who can get a malicious file into a repository the agent reads gains code execution with the developer’s full account privileges — no phishing, no credential theft required.

What Teams Should Do Now

The JFrog report’s prescription centers on extending existing governance to cover agent traffic — through what they call Agent Package Resolution: session steering that directs agents to governed repositories, persistent package-manager configuration that prevents public registry access, and server-side curation policy enforcement. The goal is not to change agent behavior but to wrap it in the same controls that govern human-initiated installs.

For teams not yet running JFrog Artifactory or an equivalent, a shorter list of immediate actions applies. Redirect $HOME to a sandboxed directory before running agents, so credential files are inaccessible by default. Disable auto-yes execution modes in Cursor and Claude Code — most supply chain attacks via GuardFall require command execution to be enabled. Audit what MCP servers your agents can reach; the 18% with zero governance there are the most exposed. And if you’re pulling models from Hugging Face directly, run them through a scanner before loading — 495 malicious models is not a theoretical number.

The deeper problem is organizational. The 97% governance confidence figure exists because most companies measured governance at the policy layer, not the enforcement layer. The agents arrived and routed around enforcement without anyone updating the measurement. Closing that gap requires treating agent-initiated network traffic the same way CI/CD pipeline traffic is treated: as untrusted by default, routable through inspection, and auditable after the fact.

Further Reading

• JFrog 2026 Software Supply Chain Security Report — the primary source; dense with statistics and the full methodology behind the 451% npm figure
• SecurityWeek: Bash Tricks Expose AI Coding Agents — detailed breakdown of the GuardFall vulnerability and which agents are affected
• JFrog: Supply Chain Attackers Are Coming for Your Agents — practical mitigations and how JFrog’s Agent Package Resolution actually works