Vibe-Coding Due Diligence: Why AI Agent Plugins Are Your Next Supply Chain Risk
Agentic AIEnterprise software procurement has governance procedures for a reason. Vibe-coding tools are bypassing all of them.
What’s Actually Happening on Developer Machines
When a developer installs a Cursor rule file, a Codex custom command, or an MCP server extension, they’re typically pulling from a public GitHub repository, copying a config someone posted in Slack, or pointing their agent at a personal Git fork. Each of these represents an acquisition of software that runs with significant permissions: hooks that execute shell commands on agent events, MCP servers that broker access to databases and credentials, subagents that read and modify repository files.
This is exactly what procurement governance procedures exist to prevent: software acquired outside of any review or approval process, with no version control, no provenance tracking, and no audit trail — running directly in the development environment with access to source code and credentials.
The Attack Vector
JFrog’s security team has outlined the specific risk scenario: a malicious update is pushed into an agent plugin in a public GitHub repository that a development team is pointing their agents at. Within hours, every developer who syncs pulls down code that executes arbitrary shell commands on their machine, inside their source code, under their credentials.
This attack vector doesn’t require compromising the GitHub account of a well-known developer. It only requires maintaining a popular-enough plugin repository — or compromising one. The mechanics are identical to the npm supply chain attacks that have targeted developer environments for years. The difference is that agent plugins execute with even more ambient authority than a build-time script dependency, because they run interactively inside the agent’s operational loop.
Git version control — the format most agent plugins are distributed in — provides mutable tags and moving targets rather than reproducible, pinned dependencies. A tag can be re-pointed. A branch tip can change. This is the fundamental governance gap that package registries like npm and PyPI were designed to solve for traditional software dependencies.
The Governance Answer
JFrog’s Agent Plugins Repositories feature treats agent plugins as first-class managed artifacts in Artifactory: signed, immutable versioned releases with provenance, enterprise access controls, audit trails for compliance, and upcoming security scanning integration. This brings the same governance that organizations apply to Docker images and npm packages to the AI coding tool layer.
The practical implementation forces a discipline most teams aren’t applying: instead of developers pulling plugins directly from GitHub, the enterprise pins specific signed versions through an internal registry, with policy controls over which plugins are approved.
Why This Is a Now Problem
The timing of this governance gap matters. Enterprise vibe-coding adoption is accelerating faster than security review processes are adapting. Teams that spent 2023–2024 evaluating whether to allow GitHub Copilot are now finding that their developers have independently installed three or four additional AI coding tools with custom extensions — all acquired outside any IT or security review.
The path of least resistance in AI coding tool adoption has created an unmanaged software acquisition surface. Every plugin a developer installs is software their organization is acquiring and running with elevated trust. Organizations that don’t treat it that way will eventually discover why it should have been.
The So What
The due diligence question for enterprise AI adoption in 2026 isn’t just “which LLM should we standardize on?” — it’s “what are our developers acquiring on our behalf when they extend their coding agents, and do we have any visibility into it?” JFrog’s Agent Plugins Repositories is the enterprise answer to that question. For teams that aren’t ready for a full Artifactory deployment, the minimum viable version of this practice is a pinned, reviewed list of approved agent plugins maintained by engineering leadership — with explicit policy against pointing agents at arbitrary public GitHub repos. The npm supply chain lesson is well documented. There’s no reason to re-learn it with higher-privilege software.
Source: JFrog Blog
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →