Coding Agents Just Reopened Your Software Supply Chain Blind Spot

Most organizations spent years hardening their software supply chain. The model is familiar: dependencies flow through a controlled repository, policies determine what is allowed, scanning catches what slips through, and every action is logged for auditability. It works because human developers operate within environments that enforce these rules.

AI coding agents break that assumption entirely.

Tools like Cursor and Claude Code introduce a new way to build software. Instead of explicitly selecting dependencies, users describe intent in natural language. The agent decides what packages are needed and retrieves them autonomously. A prompt like “build an app to track a stamp collection” can trigger a cascade of dependency downloads: database drivers, image libraries, and frameworks, without the user ever naming a single package.

And by default, those dependencies are pulled directly from public registries: npm, PyPI, Maven, Go, Docker Hub, Helm, NuGet.

The threat isn’t hypothetical. Malicious npm package activity surged 451% in 2025, reaching more than 171,000 unique malicious packages, according to JFrog’s Software Supply Chain Security State of the Union 2026 report. Researchers also documented nearly 20% of AI-generated package recommendations referencing packages that don’t exist — a class of attack researchers call “slopsquatting,” where attackers register malicious packages under names that AI models repeatedly hallucinate.

This is where the blind spot emerges. The governed path you built still exists, but agent-driven traffic bypasses it entirely. Downloads happen outside your controlled repositories, meaning curation policies, security scanning, and audit trails are never applied. This is not an edge case. It is the default behavior. And the blind spot grows every time agentic coding reaches one more person who never knew your rules existed.

The fix is not a new perimeter. It’s making sure your current one covers a new class of requester. That’s why we’re excited to announce Agent Package Resolution (in preview), which lets AI coding agents natively resolve packages through JFrog Artifactory, your system of record for every package the organization consumes.

Agent Package Resolution: Making the Governed Path the Only Path

Agent Package Resolution, a feature of JFrog Agent Plugin, puts agent-driven downloads on the same governed path as everything else, without requiring developers to configure anything. It’s available for Claude Code or Cursor now with more agents coming soon.

1. Session steering — At the start of each agent session, Agent Package Resolution gives the agent the Artifactory URL for each governed package type. This handles the majority of downloads automatically and requires no persistent configuration per-project.
2. Persistent package-manager configuration — A one-time jf setup command binds the local package manager to your Artifactory repository for a given project. This layer persists across sessions and tools, independent of any single agent conversation. Even indirect installs — a postinstall script, a pip install -r requirements.txt — route correctly from the first session.
3. Server-side JFrog Curation enforcement — Regardless of whether the first two layers are in play, your server-side JFrog Curation policy governs what is allowed through Artifactory. An agent that ignores session steering, or a developer who bypasses configuration, still hits the same curation and scanning wall as every other request.

Each layer provides independent enforcement. Governance doesn’t rely on agent compliance, it’s enforced end-to-end.

What Does Agent Package Resolution Cover?

Every dependency flow is brought under governance. The following highlights what is covered once Agent Package Resolution is enabled:

• Direct package installs — Packages requested by name in agent-generated code resolve from your governed JFrog Artifactory repositories, not the public registry.
• Indirect and transitive installs — Postinstall scripts, dependency chains, and bulk pulls triggered by pip install -r, npm ci, or equivalent commands all route correctly from session one.
• JFrog Curation policy enforcement — Every package, regardless of origin or who requested it, passes through your existing JFrog Curation rules. Malicious packages, unapproved licenses, and packages that violate your policy are blocked at the gate.
• JFrog Xray scanning — Every artifact is scanned for known CVEs, license violations, and operational risk. The same scan that applies to human-driven builds applies to agent-driven builds.
• Complete audit trails — Every download, block, and policy decision is logged. Your audit history stays intact regardless of whether a human or an AI agent made the request.

Agent Package Resolution brings every one of these flows under the governance perimeter you already built — it just extends that perimeter to cover a new class of requester.

Zero-Touch for Developers, Full Control for Platform Teams

Adoption does not require retraining developers or changing workflows. Turn it on broadly all at once, or phase it in with a controlled release. Once zero-touch setup is enabled, the plugin binds local package managers in the background when a session starts. Even indirect installs, like a postinstall script or a pip install -r, route correctly from a developer’s very first session. No one has to be trained, and no one has to remember to opt in.

You still control the scope. You choose which package types are governed, so coverage matches your policy instead of an all-or-nothing default. Anything you do not declare is left alone, with no half-configured state to explain to developers.

Who Benefits, and How?

Agent Package Resolution addresses the governance gap without adding friction for developers or requiring retraining. The table below summarizes how each team benefits.

The result is governance parity across every team, without asking anyone to change how they work.

Speed Without Compromise

AI coding agents are not going away, and neither is the risk they create. The fix is to bring agent-driven development under the same governance perimeter as everything else, automatically, before the ungoverned downloads pile up.

Grab the plugin on GitHub for Claude Code or Cursor, or talk to your JFrog rep to get started.