Wiz reports on software supply chain and AI agent security

Wiz has identified growing vulnerabilities within the software supply chain, specifically regarding Kubernetes and open-source packages. The company introduced WizOS Helm charts to mitigate security gaps in Kubernetes, noting that traditional scanning tools often fail to detect risks in community-maintained Helm charts, such as the use of moving image tags instead of fixed digests.

Research from Wiz further highlights a rise in zero-day supply chain attacks. These incidents, involving compromised open-source packages, rose from approximately 10% of significant security incidents in the second half of 2025 to 25% in the first half of 2026. The company noted that malicious code can enter development pipelines before traditional vulnerability databases can flag the threat, citing the Axios npm package compromise as a notable example.

The integration of AI coding agents into development workflows is adding new layers of complexity. While tools like Cursor can increase code generation velocity, research indicates these gains often dissipate after two months and are accompanied by a 30% rise in static analysis warnings and a 41% increase in code complexity. Security concerns are heightened because AI agents often operate with the full access rights of a developer, potentially exposing credentials or sensitive files. Some agentic command-line interfaces have been observed running commands without explicit user approval, which could allow for the execution of destructive commands or the exploitation of repository-based prompt injection attacks.

In response, companies such as NVIDIA and Cisco are developing security layers, including NVIDIA OpenShell and Cisco DefenseClaw, to provide zero-trust sandboxed environments and identity-aware policies for agentic workflows. Experts also recommend implementing Spec Driven Development (SDD) and maintaining rigorous human oversight to balance automated generation with architectural integrity.