API Security Escalates: Supply Chains, Non-Human Identity & Agent Safety
Key Questions
What recent supply chain attacks targeted AI developer tools?
Fake Claude Code installers via Google Ads stole API keys and crypto wallets, while a GitHub breach exposed 3,800 internal repos through a VS Code extension.
How are companies addressing API security for AI agents?
Salt Security released 100 pre-built policies for agentic AI governance, while Cyberhaven and others integrate compliance APIs from ChatGPT Enterprise and Claude.
What vulnerabilities affect popular AI frameworks?
A critical Starlette/FastAPI vulnerability impacts vLLM, LiteLLM, and many agent platforms, prompting urgent patching across the ecosystem.
How do partnerships enhance AI API security?
Harness and Kong expanded their partnership for automated AI discovery and gateway security, while Fastly collaborates with Experian for agent verification at the edge.
What frameworks help control API sprawl in AI environments?
Analyses show 45% of AI code introduces vulnerabilities and 10-20% shadow APIs, recommending SDLC-based governance and strict access scoping for non-human identities.
Unauthorized agent actions and connected API control planes keep delegated authority, CI/CD trust, non-human identity, runtime containment, and provenance in focus. Didit's modular identity-and-fraud API, webhook and sandbox tooling, and MCP server reflect growing agent-ready identity services, but coverage, speed, and compliance claims need independent validation. Effective stop controls and end-to-end visibility remain important gaps.