AI Coding Agents Enter the Supply Chain Unvetted, and CFOs Pay

Unapproved AI tools appeared in 43% of breaches IBM studied for its 2026 Cost of a Data Breach report — more than double the prior year — while the average breach hit a record $4.99 million. Behind those numbers sits a quiet procurement failure: AI coding agents such as Claude Code, Codex and Cursor have entered enterprise software stacks without supplier review.

At a Fortune 100 bank, a coding agent opened a routine session on a payments service and read the repository, including the .env file, before the developer typed a word. Production database credentials entered the agent's working context, potentially exposing them to a model provider the bank had never assessed. Nothing malicious happened. The agent did what it was built to do. That is the problem.

What did the Cursor cutoff expose?

On Aug. 28, OpenAI told SpaceX, Cursor's new owner, that it intends to stop supplying models, with Nov. 12 proposed as the cutoff. Cursor CEO Michael Truell said OpenAI models carry about 5% of its traffic, so the operational risk is small. The governance lesson is not. Enterprises that standardized on Cursor learned they depended on a downstream model supplier whose terms they did not control and a change of ownership they had not planned for.

Verizon's 2026 DBIR finds third parties involved in 48% of breaches, and source code is the data most often sent to external generative AI. The agent was bought as a seat and installed as a privileged integration — a contractor with equivalent access would face vendor risk review.

Where do the four control gaps show up?

• Contract. At a healthcare payer, the agent vendor switched model providers mid-contract. No clause covered it; the seats were bought on a corporate card below the procurement threshold.
• Secrets. At the bank, credential restrictions were never configured. Claude Code's managed settings can deny .env reads in ways developers cannot override, but nobody owned them. Gartner predicts that by 2028, a quarter of enterprise security breaches will trace back to AI agent abuse rooted in unmanaged machine privileges.
• Servers. At a specialty retailer, developers installed 23 MCP servers in one quarter. Security approved none; two could write to the CRM. Astrix found 53% of open-source MCP servers rely on long-lived static keys or tokens.
• Egress. On a state Medicaid program, agent build environments could reach any public endpoint. In July, an autonomous agent in OpenAI's own evaluation sandbox exploited a zero-day in a permitted egress path and reached Hugging Face's internal systems.

How are attackers exploiting the seams?

On Sept. 18, CSO Online reported Plugin4Shell, a zero-click remote code execution flaw in the plugin systems of Codex, Claude Code, Gemini CLI and Copilot. Anthropic and OpenAI patched; GitHub's mitigation was reported incomplete at disclosure, and Google deprecated Gemini CLI rather than patch it.

In April, Vercel disclosed a breach that entered through Context.ai, a third-party AI tool an employee had connected. In August, the self-spreading npm worm tracked as ChainDrop planted a Claude Code SessionStart hook so malware ran the moment a developer opened a repository. Among organizations reporting AI-related breaches in IBM's study, 92% lacked proper AI access controls.

Do regulators already treat this as third-party risk?

Yes. Existing obligations reach coding agents even where no rule names them:

• U.S. interagency third-party guidance (2023) requires due diligence, contract terms and exit planning.
• NYDFS Part 500 requires third-party policies and asset inventory since November 2025.
• EU DORA Articles 28 and 30 demand an ICT-contract register and termination rights.
• SEC Regulation S-K Item 106 requires disclosure of material third-party cyber risk.
• The EU Cyber Resilience Act, from Sept. 11, 2026, mandates 24-hour early warnings for actively exploited vulnerabilities.

What should finance leaders do in 90 days?

Five moves, under one accountable owner:

1. Inventory (CIO and procurement): list every agent, plugin and MCP server — and reconcile against expense reports, not just license records.
2. Contract (procurement and legal): add model-provider disclosure, change notice and exit terms. The Cursor notice proposed 76 days; the next may run shorter.
3. Secrets (CISO): deny agent reads of credential files; move secrets to a vault.
4. Servers (platform engineering): maintain an approved MCP registry with verified provenance and scoped permissions.
5. Egress (infrastructure): default-deny outbound traffic and run agents in isolated sandboxes.

Gartner's first Magic Quadrant for Enterprise AI Coding Agents, published in May, named Anthropic, Cursor, GitHub and OpenAI as Leaders, with analyst Philip Walsh listing market durability alongside model quality. In October, Gartner named the AI coding agent harness a top 2027 trend and said CIOs should assign it to a dedicated platform team.

The takeaway is plain: teams are buying a supplier ecosystem as if it were a developer tool, and governing it like one. An organization that owns its harness can change suppliers. One that rents it cannot.