TL;DR: Operational ransomware, commercial plugin supply chain compromise, and the first verified agentic ransomware case are converging with persistent exposure to known vulnerabilities and AI-adjacent services, creating faster paths from initial access to business disruption, according to Veracode’s July 2026 briefing. The control gap is no longer visibility alone, but whether organisations can block risky ingress and shrink exploitable exposure before attackers do.
At a glance
What this is: Veracode’s briefing says appsec teams are facing a convergence of ransomware, supply chain compromise, and agentic AI-driven attacks that compress time from access to impact.
Why it matters: This matters because IAM, PAM, NHI, and application security teams now have to govern exposed services, third-party update paths, and AI-adjacent workloads as one control surface.
By the numbers:
- 79% of breaches involve previously disclosed vulnerabilities, underscoring how often known weaknesses remain exploitable.
Context
AppSec is no longer only about finding code flaws before release. This briefing describes a security governance gap in which known vulnerabilities, exposed services, commercial plugin channels, and AI-adjacent workloads can all become credible entry points before remediation teams close the window.
The article’s primary identity angle is indirect but real: when attackers move through exposed services, third-party software updates, or AI workflow platforms, they frequently end up abusing credentials, secrets, and access paths that identity and PAM programmes are meant to govern. That makes the problem broader than secure coding alone and closer to end-to-end control of ingress, privilege, and trust boundaries.
Key questions
Q: What breaks when organisations rely on visibility alone for API security?
A: Visibility alone breaks down when teams can see problems but cannot drive remediation. In practice, alerts without ownership, prioritization, and enforcement leave vulnerabilities open and allow attacks to continue. That creates a false sense of control, while APIs remain exposed to abuse, unauthorized access, and incident escalation.
Q: Why do supply chain compromises often become cloud credential incidents?
A: Because many workloads expose credential sources to the same process that runs application code. If the attacker can read environment variables or query metadata services, temporary cloud credentials become available without stealing a password. That makes workload identity scope, metadata exposure, and host secret layout decisive factors in whether a package compromise stays local or spreads into cloud access.
Q: What are the signs that an AI workflow platform is becoming an attack surface?
A: The warning signs are internet exposure, embedded secrets, weak segmentation, and production dependencies that are shared with higher-value systems. When an AI workflow tool can reach model artifacts, training data, or operational databases, compromise can quickly become encryption, deletion, or service disruption. That means the platform has crossed from development convenience into business-critical risk.
Q: Should security teams prioritise blocking and provenance over faster vulnerability reporting?
A: Yes, when the organisation already has a large backlog of known weaknesses and external trust channels that can introduce compromise. Reporting is useful, but it does not stop attackers from using a vulnerable service, malicious package, or tampered update. Teams should prioritise controls that prevent risky ingress and reduce reachability, then use reporting to verify what remains exposed.
Technical breakdown
Why known vulnerabilities still drive most breaches
Known vulnerabilities remain attractive because defenders often discover them faster than they eliminate them. In practice, the issue is not just detection coverage but whether findings are aggregated, prioritised, and blocked before an attacker can turn an internet-facing weakness into execution. When patch queues, exception processes, and fragmented tooling slow the response, even a well-understood CVE can stay operationally viable. This is why shift-left programs increasingly need runtime-aware enforcement, not just scanner output. The governance question is whether an organisation can actually shrink exploitable exposure, not whether it can catalogue it.
Practical implication: tie vulnerability management to blocking, prioritisation, and ownership so known weaknesses do not remain reachable in production.
How supply chain compromise now reaches credentials and 2FA
Commercial plugins and package ecosystems can carry trust deeper into the delivery chain than many teams realise. If a tampered update channel can inject backdoors, the attacker may inherit the application’s update trust, then move into credential theft, two-factor bypass, or hidden administrative access. That changes supply chain security from dependency hygiene to controlled ingestion, provenance, and post-update verification. The important point is that the compromise may arrive through a legitimate distribution path, not a noisy intrusion event. Once that happens, access control and account recovery become part of the security response, not just code review.
Practical implication: verify update provenance and treat plugin ingestion as an access-control boundary, not a routine maintenance task.
What agentic ransomware changes about AI-adjacent exposure
Agentic ransomware shows what happens when a malicious workflow can chain discovery, exploitation, encryption, and destruction with limited manual intervention. In the JadePuffer case cited here, the attack moved through an exposed AI workflow framework, then targeted AI model artifacts, training data, and databases. That matters because AI-adjacent systems often blend application services, credentials, and sensitive data into one operating environment. The result is a shorter path from foothold to high-value impact, especially where secrets or internet-facing services are left exposed. AI workflow platforms now need the same exposure discipline as critical production services.
Practical implication: treat AI workflow tools and model environments as production attack surfaces and reduce exposed services, embedded secrets, and standing access.
Threat narrative
Attacker objective: The attacker’s objective is to convert trusted access into fast operational disruption, credential theft, and ransom leverage across production systems and data stores.
- Entry occurs through exposed services, tampered software distribution, or a vulnerable AI workflow platform that gives the attacker an initial foothold.
- Credential access follows when the attacker uses the foothold to steal secrets, bypass authentication, or reach update-trust paths that expose administrative control.
- Escalation and impact occur as the actor encrypts systems, deletes data, or disrupts operational workflows, turning software trust and identity gaps into business interruption.
Breaches seen in the wild
- LiteLLM PyPI package breach: LiteLLM PyPI supply chain attack, credentials stolen from users.
- GemStuffer RubyGems campaign 2026: AI agents attributed to OpenAI mass-created RubyGems accounts, ran code on RubyDoc build servers and probed a flaw to steal API keys.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Exposed trust paths, not just exposed code, are now the core appsec problem. The article shows that attackers are monetising whatever organisations allow to remain reachable, whether that is a vulnerable service, a commercial plugin channel, or an AI-adjacent workflow platform. That makes policy-driven blocking and provenance controls more decisive than passive visibility alone. Practitioners should treat trusted ingress as a security boundary that must be governed continuously.
Agentic ransomware marks a shift from tool-assisted attack to workflow-assisted extortion. The important change is not simply that AI appears in the kill chain, but that the attack can progress through multiple stages with less manual friction and shorter dwell time. That compresses the room for detection, triage, and containment. Security teams should assume that production AI services can be operational attack surfaces, not experimental ones.
Credential theft is increasingly an outcome of application compromise, not a separate problem. The briefing’s supply chain examples show that update channels and plugin trust can end in 2FA theft, hidden admin creation, or secret exposure. That is an identity governance issue as much as an appsec issue because compromised software now routinely becomes a route to account misuse. Practitioners should align appsec, IAM, and PAM around the same exposure model.
Known vulnerability backlog is a governance failure when business disruption is the result. The article’s emphasis on previously disclosed vulnerabilities means the hard part is not discovery but reduction of exploitable exposure across code, containers, IaC, and external services. That calls for unified prioritisation and enforcement, especially where business-critical workflows depend on internet-facing systems. Practitioners should measure how quickly findings stop being reachable, not how many are collected.
From our research library:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Read next: Agentic AI Identity Maturity Model
What this signals
Known weakness management is now a business resilience issue, not only a scanning issue. When exposed services, plugin channels, and AI workflow tools stay reachable, attackers need less time to turn technical debt into operational disruption. That means programmes need to measure how quickly findings are blocked or removed, not just how many are discovered.
Agentic AI changes the exposure model for production services. A workflow that can chain discovery, exploitation, encryption, and deletion compresses response time and makes standing access more dangerous. Security teams should reassess internet-facing AI tooling, secrets placement, and segmentation before those systems become part of the attack path.
Third-party exposure is the new trust perimeter. According to the 2026 Infrastructure Identity Survey, 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments. That reinforces the need to align appsec, IAM, and PAM around trusted ingress rather than treating them as separate controls.
For practitioners
- Harden ingestion gates for third-party packages Block or quarantine high-risk dependency updates before they reach build and deployment pipelines, especially where commercial plugins or package registries can deliver trusted code paths.
- Inventory exposed AI-adjacent services and workflows Map internet-facing AI workflow tools, model-serving endpoints, and companion services, then remove any unnecessary exposure and embedded secrets that can become initial access paths.
- Collapse known vulnerability backlogs into one prioritised queue Correlate code, container, IaC, and runtime findings so exploitable issues are measured by reachable business impact rather than by scanner source or team boundary.
- Treat plugin trust as an access-control problem Review update channels, administrative accounts, and recovery procedures for software that can modify production behavior or harvest credentials after a compromised update.
- Build containment around AI and production secrets Scope secret scanning, rotation, and revocation to AI development, deployment, and operations paths so compromised workflow tools cannot expose long-lived credentials.
Key takeaways
- Operational ransomware, commercial plugin compromise, and agentic AI abuse are converging into a faster path from access to disruption.
- The article highlights a persistent weakness in how organisations handle reachable exposure, update trust, and known vulnerabilities across code-to-cloud surfaces.
- Teams that want lower business impact need controls that block risky ingress, reduce secrets exposure, and convert findings into enforced reduction of attack surface.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK, OWASP API Security Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006;TA0008;TA0040 — Credential Access; Lateral Movement; Impact | The article centres on credential theft, movement through trusted paths, and disruptive impact. |
| Recommendation — Map exposed-service and supply-chain incidents to TA0006, TA0008, and TA0040 to prioritise containment. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Trusted update paths and exposed services become dangerous when access is over-broad or poorly governed. |
| Recommendation — Apply PR.AA-05 to narrow access on AI workflow tools, plugins, and production services. | ||
| CIS Controls v8 | CIS-5 — Account Management | Credential theft and hidden admin access are central failure modes in the briefing. |
| Recommendation — Use CIS-5 to inventory, review, and revoke accounts that update channels or plugins can reach. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | The article repeatedly returns to compromised access paths, secrets, and identity misuse around exposed services. |
| Recommendation — Apply API2 controls to exposed AI and application endpoints so authentication weaknesses do not become footholds. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The briefing explicitly notes secrets in AI and cloud/IaC environments as a recurring initial-access factor. |
| Recommendation — Scan and revoke leaked NHI secrets in AI workflow, container, and IaC environments before they are abused. | ||
Key terms
- Agentic Ransomware: Agentic ransomware is malware or a ransomware operation directed by an autonomous system that can plan, adapt, and change attack steps at runtime. The key difference is behavioural flexibility, which shortens response windows and makes rigid playbooks less effective.
- Software Supply Chain Compromise: A software supply chain compromise is an attack that inserts malicious code into trusted build, package, or deployment paths. The goal is often not immediate application failure, but secret theft, persistence, or unauthorized changes that travel downstream through automated systems.
- Identity-Reachable Exposure: Identity-reachable exposure describes a vulnerability or control weakness that can be accessed through a real identity path, such as a service account, API key, token, or workload credential. It is a useful way to connect application risk to the identities that can actually trigger or abuse it.
- Trusted ingress: Any update, integration, or service path that organisations allow to enter production on the assumption that it is legitimate. When that trust is not governed, the ingress path becomes a security boundary that attackers can use to pivot into credentials, accounts, or runtime systems.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. The course is designed for practitioners who need to connect machine identity, access governance, and AI risk into one operating model.
Published by the NHIMG editorial team on August 1, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org