The AI Arms Race Inside Your Company

Last month, a North Korean hacking crew called Sapphire Sleet hijacked the most popular AI-agent framework on npm — Mastra — and backdoored more than 140 packages in under 90 minutes. The same week, JetBrains confirmed that 15 malicious plugins had been quietly harvesting developers' AI API keys from 70,000 installations since October 2025. And in April, RAND published a study showing that AI agents can now autonomously breach complex systems in under an hour, for less than $20 in API costs.

These are not separate stories. They are three fronts in the same war — and that war is happening inside your company right now.

Three Armies, One Battlefield

Here is the uncomfortable reality executives need to understand: AI is simultaneously being used to defend your organization, attack it, and — through your own developers — introduce the very vulnerabilities that make both sides' jobs easier.

The defenders are gaining ground. Anthropic's Project Glasswing, now expanded to roughly 200 partner organizations across more than 15 countries, has surfaced over 10,000 high- or critical-severity vulnerabilities in widely used software since its April launch. The program upgraded from Mythos Preview to Claude Mythos 5 in June, and a 90-day public report on fixed vulnerabilities is expected this month.

The attackers are gaining ground faster. The RAND study I referenced above deserves a closer look. In early 2026, RAND ran a controlled trial with 157 participants and found that AI chatbots gave lower-skilled attackers only marginal uplift — they could get started faster but couldn't finish sophisticated attacks. Then RAND retested with AI agents — autonomous systems that plan and execute multi-step operations — and the results flipped dramatically. The agents solved every Capture the Flag challenge in under an hour, with minimal human guidance. Offensive cyber capability that once required years of expertise is now available to anyone with an API key.

Your own developers are, unwittingly, the third army. Veracode's Spring 2026 study tested over 150 large language models and found that 45% of AI-generated code samples introduce OWASP Top 10 vulnerabilities. AI-assisted developers produce commits at three to four times the rate of their peers — but introduce security findings at ten times the rate. Jack Cable testified before the House Homeland Security Subcommittee on June 4 that 13% of agent-generated code changes contain vulnerabilities, while GitHub reported 14 times more code committed in 2026 than in 2025. Google CEO Sundar Pichai disclosed that 75% of the company's new code is now AI-generated.

Read that again: the same technology defending you is also attacking you and creating new holes for attackers to find. This is the three-way tension I warned about in Chapter 4 of Cyber Risk Is Business Risk — the AI genie is out of the bottle, and it's working for every side at once.

The Supply Chain Is the New Front Line

The JetBrains and Mastra incidents are not footnotes. They represent a structural shift in how attackers operate.

In the JetBrains case, attackers built plugins that mimicked popular AI coding assistants — offering code completion, commit generation, and bug detection powered by DeepSeek and OpenAI. Developers installed them willingly. The plugins ran in a highly trusted, always-on environment with no sandbox restrictions and complete file system access. Every time a developer saved an API key, it was silently exfiltrated.

The Mastra attack was worse. Microsoft attributed it to Sapphire Sleet, a North Korean state-sponsored group. At 01:01 UTC on June 17, they published a typosquat package mimicking the popular dayjs library. Within minutes, trojanized Mastra releases went live. Mastra is a TypeScript framework for building AI agents — the very tools developers use to wire API keys, cloud credentials, and model access into applications. Any developer workstation or CI/CD pipeline that ran npm install after the compromised versions were published was potentially exposed.

This is not a hypothetical risk for boards to monitor abstractly. If your developers use AI coding tools — and they do — your organization is exposed to supply chain attacks that specifically target the AI development pipeline.

Why the "Sheriff" Metaphor Matters Now

In Chapter 8 of Cyber Risk Is Business Risk, I introduce the idea that AI governance requires a "sheriff" — someone (or some structure) with the authority and mandate to set rules for how AI operates within your organization. Most companies still don't have one.

The CSA/Zenity study from April 2026 confirms this gap in stark terms: 53% of organizations have had AI agents exceed their intended permissions. Nearly half experienced a security incident involving an AI agent in the past year. Only 15% have defined ownership for most of their AI agents. And 74% of enterprises expect to have over 100 agents live by the end of 2026.

Without a sheriff, you have a three-front war with no unified command. Your security team runs Glasswing or similar defensive AI. Your developers use Copilot, Cursor, or Claude Code to ship faster. Your attackers — state-sponsored and otherwise — use AI agents to find and exploit the gaps. Nobody is looking at the whole picture.

The June 4 Congressional hearing made this explicit. Chairman Ogles emphasized that existing patch management and review processes were not built for the volume and speed at which AI can introduce, find, and exploit vulnerabilities. Witnesses warned that adversaries are already inside U.S. critical infrastructure, and AI is collapsing the timeline to exploit it.

What to Ask Your CISO This Week

The governance framework I outline in Cyber Risk Is Business Risk — built around Three Questions that every board should ask — applies directly here. Start with these:

1. Do we have an AI supply chain inventory? Not just what AI tools your security team uses, but every AI-powered plugin, extension, framework, and agent your developers have installed. The JetBrains attack targeted 70,000 developer installations. Would your team know if your developers were among them?
2. Who owns AI agent governance? The CSA/Zenity study found that only 15% of organizations have defined ownership for their AI agents. If an agent exceeds its permissions — and more than half do — who is accountable?
3. Are we red-teaming with AI? If RAND has demonstrated that AI agents can autonomously breach systems in under an hour, your penetration testing methodology is already outdated if it doesn't include AI-powered offensive testing. What you don't test for, you can't defend against.
4. What is our AI-generated code review policy? When 45% of AI-generated code introduces known vulnerabilities, shipping AI-assisted code without security-specific review is accepting risk your board may not be aware of.

For the full governance framework, including the Three Questions and the board oversight model for emerging technology risk, see Chapters 4 and 8 of Cyber Risk Is Business Risk.