How AI Coding Agents Got Hacked: The 2026 CI/CD Supply-Chain Reckoning
In 2026 the attack surface moved from your editor to your issue tracker. A malicious GitHub issue title backdoored an npm package, three major agents were shown to treat PR text as commands, and trusted PyPI libraries shipped credential-harvesting malware. Here is what happened and five defenses that hold.
Devdatta Narawade7 min