Recently I asked an AI assistant to tidy a messy spreadsheet and chart the result. Nothing exotic. To do the work, it spun up a sandbox, pulled a handful of open source packages into that environment, and ran them. I didn't write any code. I didn't ask for any code. Packages I had never seen were fetched and executed on my behalf, and it was over in seconds.

That was a software supply chain event. It happened in a workflow that no scanner, no registry proxy, and no review process was watching. And it is now happening across every company that has handed its people AI agents.

I have spent years running security for large enterprises. I have seen how hard it is to make supply chain controls work in real developer workflows. For years, we worried about the dependency a developer chooses and commits. The new exposure is the dependency nobody chooses, pulled into a throwaway environment by an agent doing exactly what we asked.

The vibe coding revolution is changing how code gets written and run inside our environments. The same AI capabilities have changed the threat landscape we operate in just as dramatically. Two shifts stand out. The skill barrier collapsed. Turning stolen commit rights into a backdoor that survives review used to take patient, expert context on a codebase. A prompt close to "help me land a change that looks routine and quietly does something extra" now produces code that passes a casual read. And the surface exploded. More and more new code never reaches a repository at all. It runs once inside an agent's sandbox, in a place no scanner is watching, and then it is gone.

The toolkit most teams own was not built for this. Traditional vulnerability management is a forensic instrument. It answers "where did we use this package, and which versions," which is what you want weeks after a compromise surfaces. Baked in is an assumption: attacks are rare and you have weeks to respond.

Today's attacks run in tens of minutes. When the copyfail issue broke, the team that disclosed it said a working exploit existed within about two hours of the patch becoming visible. The window from a malicious package landing in a registry to a real project importing it is even faster, measured in just a few minutes.

The popular self-help fix is a cooldown: refuse any package version less than seven days old. The logic holds on the supply chain side. But a cooldown also delays every security patch you ingest, and the patch-to-exploit window is now hours. You have reduced one exposure by widening another. I worked through this trade-off, and the broader agent blind spot, with James Wilson on Risky Business Features.

What works is governance at the point of ingest. A threat intelligence feed that knows which packages are compromised right now, updated by the hour. And a control point that can refuse to download, or refuse to build, the moment something on that feed lands in your dependency tree.

The hard part is where that control point lives. Code now enters in more places than the org chart admits. The build pipeline is the easy win. The developer laptop is the quiet gap, because the share of developers routing through a central proxy is always smaller than the security team believes. The agent environment is the gap almost nobody has mapped, and it is growing fastest.

My first chance to work with Socket was as a customer. In my last operating role, running security at a global company, I ran a Socket deployment. It went live faster than we planned, and that experience as a buyer made the conversation easy when Feross asked me to advise. I joined as a strategic advisor in April.

What impresses me from the inside is the hustle. This is a team with a real desire to solve customer problems. It reads the market closely and moves fast on what it hears. The constant is the threat intelligence feed. The interesting part is how many ways they keep finding to bring it to bear. Their original software composition analysis fit the build pipeline. Socket Firewall is the right answer for the vibe-coded endpoint that skips the build pipeline entirely. They are nowhere near done, and what they have brewing is aimed at the right ergonomics for the person actually in the workflow. Feross spent more than a decade as a maintainer before founding Socket. It shows in defenses built by people who understand how maintainers publish and how attackers move.

The market is voting. Socket has grown from 7,500 organizations to more than 27,000 and blocks more than ten thousand supply chain attacks every week. When the Axios compromise hit, it flagged the malicious dependency within six minutes, and more than 2,000 organizations onboarded within 24 hours.

Five years out, I expect a threat feed wired into an ingest control to be a standard layer of the stack, the way endpoint detection is today. We are in the early innings, and the teams that get there first will spend far less time on incident calls than the ones that wait.