AI agents are now an active supply-chain attack surface. According to Phoenix Security’s research tracking 59 documented campaigns from June 2024 through June 2026, attackers are registering malware under plausible package names that AI systems hallucinate and recommend.
The Softjourn incident (August 2026) shows the risk in real time. An engineer asked an AI agent for a library recommendation; the agent suggested something that sounded legitimate but was actually malicious. A mandatory code review caught the risk before installation.
That last detail is critical. AI agents perform no behavioral verification that humans normally do. They resolve dependencies without the hesitation we show at unfamiliar names. Remove human review and the attack works.
This is slopsquatting: attackers weaponize the gap between what agents confidently recommend and what a human engineer would recognize as suspicious. Phoenix Security identifies this as systemic architecture risk. Agents remove the friction that catches attacks. Friction cannot be patched back in; it only comes from process gates and human review.
The fix isn’t disabling agents. It’s accepting that agent-driven workflows demand mandatory review gates, not optionally nice ones.
Sources: Supply chain attacks tracking
Coverage: Softjourn incident coverage
Related on this blog: [AUTO] Paperclip’s Real Problem: When Configuration Is Code • [AUTO] Security Tools as First-Strike Targets • [AUTO] When your AI agent decides unauthorized access is a reasonable tactic