JFrog Report Maps Agentic Development Attack Paths
On May 20, 2026, JFrog reported that its 2026 Software Supply Chain Security report identifies AI models, agent skills, MCP servers, and developer tooling as expanding attack surfaces in software supply chains. It reported 177,000 new malicious packages, 495 malicious AI models, a 451% increase in infected npm packages, and a survey finding that 53% obtain models from public registries.
On May 20, 2026, JFrog reported findings from its 2026 Software Supply Chain Security report, which identifies AI development tooling as a widening software supply chain security concern. The report extends the focus beyond conventional package registries to models, agent skills, and developer workflows. Its findings were highlighted again in an August 26 article on AI-driven software development risks.
JFrog reported 177,000 new malicious packages, 495 malicious AI models, and a 451% increase in infected npm packages. The company based the report on data from 18.2 billion artifacts managed through its platform, original research by its security team, and a survey of 1,508 security and DevOps professionals.
According to JFrog's survey results, 97% of organizations reported having AI governance, but 53% said they still source models from public registries where malicious payloads have been identified. JFrog CEO and co-founder Shlomi Ben Haim said attackers are targeting "trusted models, registries, and agentic tools" used in AI-powered development.
Agents add dependencies beyond code packages
JFrog's March analysis of the LiteLLM supply chain compromise described a broader change in the software development lifecycle: developers increasingly coordinate multiple agents for code generation, testing, research, and deployment. The company identified AI packages, MCP servers, models, and skills as components that can add dependencies to an agentic workflow.
This architecture matters because an agent can combine a model with tools, credentials, package ecosystems, prompts, and external services. A compromise in any one of those layers can affect an automated workflow with access beyond a single developer's local environment.
The March post cited the March 24 LiteLLM compromise and the earlier Shai-Hulud npm worm as examples of supply chain attacks targeting trusted development dependencies. It described Shai-Hulud as a self-replicating worm that stole developer tokens and reinfected packages maintained by affected developers.
Governance coverage is not equivalent to enforcement
The reported gap between stated AI governance and public-registry model sourcing is particularly relevant to teams deploying coding agents or internal agent platforms. Security programs for comparable toolchains commonly need provenance controls across artifacts, models, tools, and agent configuration, rather than relying solely on vulnerability scans of application dependencies.
JFrog frames its recommended approach around a single system of record for binaries, models, and agent skills from pipeline intake through production deployment. The report does not establish how broadly organizations have implemented those controls, but its findings underscore that AI-assisted development introduces supply-chain objects that conventional package-focused policies may not fully cover.
Key Points
- 1JFrog recorded 177,000 malicious packages and 495 malicious AI models, expanding supply chain monitoring beyond conventional code dependencies.
- 2Survey results show a governance gap: 97% reported AI governance, yet 53% source models from public registries.
- 3Agentic workflows combine models, tools, MCP servers, and credentials, creating multiple dependency layers that comparable security programs need to govern.
Scoring Rationale
The report provides concrete indicators of growing attack activity across packages and AI model ecosystems, a relevant operational concern for teams using agents in development workflows. Its findings are based largely on JFrog platform telemetry and survey responses, and the underlying report was published in May, limiting its immediate novelty.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
