Your Agent Stack Is a Supply Chain Now — And Nobody Is Inventorying It

Three Incidents, Three Different Shapes

Start with the specifics, because the specifics are the argument.

A Claude Code VS Code extension, distributed through the Cursor Marketplace, was found to be backdoored. The thread reached 1,008 points and 553 comments on Hacker News. Not a library — an extension, installed through a marketplace developers trust by default.

OpenCode was breached, and user credentials leaked. 977 points, 185 comments. Not a package and not an extension — an application. A tool people installed to write code with a model.

LiteLLM 1.107.0 on PyPI shipped with a credential stealer and a backdoor. 596 points, 201 comments. This one is a package, the class of artifact existing scanners are actually built for.

Three weeks of October, three incidents, three different artifact classes. Now ask the question that matters: what single tool would have caught all three?

Nothing in the current market. Snyk and Socket are excellent at the package layer — Socket probably did flag LiteLLM. Neither of them has a data model that can represent a Claude skill, an MCP server config, or a harness plugin directory. Dependabot reads manifests, and a

.agents

directory is not a manifest.

That asymmetry is the whole story: October's incidents span extension, application, and package, and a scanner built for any one of those classes would have missed two of the three.

The Thing That Made It Worse

If those were three isolated incidents, this would be a cautionary post about supply-chain hygiene. They aren't, because of a structural change that happened around them.

Coding agents became resident software.

Codex CLI installs a persistent, self-updating background daemon by default, with no opt-out. That was a front-page issue with 610 points and 294 comments — people were not complaining that a daemon exists, they were complaining that they could not inspect it or turn it off.

In the same window, developers discovered that Claude Code regularly sends each background agent's transcript to its model — 588 points, 236 comments.

Put those two facts together with the incidents. A tool that runs once and exits has a bounded blast radius: if it's compromised, you reinstall, rotate credentials, and move on. A tool that stays resident, self-updates, and holds credentials has an unbounded one. Compromise in that environment isn't an incident — it's a standing capability that keeps working after the news cycle ends.

And critically: the software that self-updates is the software you cannot enumerate. You approved version 1.2 on Monday. Version 1.3 arrived silently on Thursday. Nobody wrote it down, because there was no mechanism to write it down.

What the October Data Actually Shows

Let me be precise about the evidence, because it's easy to over-read a busy month.

The demand is not hypothetical. Three front-page threads totalling 2,600+ points and over 900 comments, all in one month, all from developers who installed something that turned on them. In each thread, the first detection came from an affected user — not from a monitoring tool, not from an advisory feed, not from a marketplace review process.

The reaction was DIY, and that's the real signal. When developers respond to a missing product by shipping their own partial version, you're looking at a gap rather than a niche. In the same month: Pi pod (121 points) runs a coding agent in sandboxes on your own server. Omnara (114 points) is an open-source alternative to a managed agent product. Offrun (78 points) manages every coding agent from one workspace.

Three products, three adjacent slices, one month. Each started from its own harness and generalised outward. None of them gives a developer a cross-agent view of what is resident, what it can reach, and what it sent.

And the adoption signal for the category itself is real. Microsoft's TokenEconomizer reached 4,557 stars for instrumenting coding agents to control cost. Teams will install instrumentation aimed at their own agent stack when the cost of not doing so is visible. Spend visibility and integrity visibility are the same purchasing instinct pointed at two different risks.

Why the Incumbents Can't Fix This Fast

The obvious objection: won't Snyk or Socket just add agent-skill support?

Maybe, within a quarter. But there's a structural reason it's not a natural extension for them, and it's the same reason this gap has stayed open.

Their unit of attribution is the repository. The risk sits on the laptop. Snyk and Socket answer "what does this repo depend on." The October incidents answer a different question: "what is installed on the machine that holds my client's source code and my production credentials." Those are different artifacts, different buyers, and different deployment models. A repository-centric alert is the wrong shape for a machine-level exposure.

Their buyers don't buy this. Security tooling for repos is purchased by platform and security teams. Per-developer-laptop inventory is purchased by the developer, or by a tech lead with discretionary budget. Moving down-market means a different price point, a different sales motion, and — for a company with a platform strategy — a different product category. Companies are slow to enter categories that contradict their positioning.

Neutrality is unavailable to vendors. Cut the other way: the most obvious alternative would be for a harness vendor to ship an inventory panel. But no harness vendor will publish a panel that lists a competitor's agent next to its own. Neutrality across harnesses is a structural position only a third party can hold.

What a Real Inventory Actually Requires

If you were building this — or evaluating whether someone built it well — here's the test. Four properties, and any tool missing one of them doesn't solve October's problem.

1. Coverage across artifact classes, not just packages. Skills, MCP server configs, editor extensions, harness plugins, and their transitive npm/PyPI dependencies. If it only sees packages, it's a lighter Snyk.

2. Version pinning and hashing. A snapshot of a moving target is not an inventory. If the tool doesn't resolve and hash versions, it can tell you what was installed yesterday and nothing about what's running now.

3. Machine-level, not repository-level. The question a founder actually gets asked — by a client, an insurer, or a questionnaire — is about a laptop, not a git remote.

4. A human-reviewed advisory stream. This is the part everyone underestimates. OSV and the GitHub Advisory Database do not have a category for "an agent skill was compromised." October's three incidents exist as blog posts and social threads. Even a perfect inventory has nothing to match against unless someone curates the feed by hand.

That fourth point is where the durable business lives, and it's why this is harder than it looks. The scanner is a weekend project. The curated, verified, dated advisory archive is a year of disciplined work — and it's exactly the kind of asset that cannot be copied after the fact.

The Honest Caveat

One thing the October data does not prove: that developers will pay for this.

There's plenty of evidence they care. Two threads with a thousand comments each, three independent builders shipping partial tools, a Microsoft project pulling 4,500 stars. What's missing is any evidence that a developer reached for their card.

That's not a reason to dismiss the problem — it's a reason to test it cheaply. The right first experiment is a free, read-only scan that produces a shareable inventory in thirty seconds. If that artifact gets shared, the paid tier (advisories, drift alerts, team dashboard) has something to sit on. If nobody shares it, the thesis is wrong and you learned that in two weeks instead of two quarters.

What to Do This Week

1. Enumerate your own machine's agent tooling. Walk your config directories and write down every skill, MCP server, extension and plugin you've installed. Most developers are surprised by the count. Note which ones self-update and which ones hold anything resembling a credential.
2. Pin what holds credentials. Pick the three agent tools with the broadest filesystem or network reach and lock their versions where the harness allows it. A self-updating tool with credential access is the combination that made October expensive.
3. Ask a client's question about yourself. "What AI tooling runs on the machine that holds my client's data, and what can it reach?" Write the answer down. If it takes more than fifteen minutes to produce, you've found the gap in your own setup.
4. Watch the advisory gap. Search OSV and the GitHub Advisory Database for any of October's three incidents. They aren't there. That absence is the clearest measurement of how immature this layer still is.

The Bottom Line

October wasn't a bad month for supply-chain security — it was a month that revealed the agent tooling layer has a supply chain at all, and that nobody has built the inventory for it.

The pattern is familiar from every prior infrastructure generation: containers existed for years before anyone shipped a scanner, and serverless existed for years before anyone shipped a cost dashboard. The window between "the architecture arrives" and "the tooling catches up" is where a one-person company can still be first.

What makes this one urgent rather than theoretical is the residency shift. A tool that self-updates and holds credentials is not a dependency you can audit once. It's a standing exposure that requires a standing record — and right now the only record most founders have is a memory of what they installed and a hope that nothing changed.