Supply chain: AI tools install code of unknown ownership in corporate networks

Aug 25, 2026 · Issue 4 · 7 sources, 7 articles

A campaign called Hades uses coding assistants as an attack path, and other reports say Claude, Codex and Hermes installed unowned code inside corporate networks. AI supply chain risk is showing up in developer workflows first.

Who is affected and how

CTO

Assign an owner for code that agents bring in.

Narrative: The coding agent is the new attack surface

Sources

• When Your AI Coding Assistant Becomes the Attack: The Hades Supply Chain Campaignmorphisec · Aug 28, 2026
• When Your AI Coding Assistant Becomes the Attack: The Hades Supply Chain Campaign | Morphisec Blogmorphisec.com · Aug 28, 2026
• AI supply chain risk is showing up in developer workflows firsthelp net security · Aug 25, 2026
• AI supply chain risk is showing up in developer workflows first - Help Net Securityhelpnetsecurity.com · Aug 25, 2026
• Claude, Codex, and Hermes installed unowned code inside corporate networksars technica · Aug 27, 2026
• Claude, Codex, and Hermes installed unowned code inside corporate networks - Ars Technicaarstechnica.com · Aug 27, 2026
• Top AI tools including Claude, Codex, and Hermes installed suspicious code inside corporate networks | TechRadartechradar.com · Aug 30, 2026

Machine-generated summary based on the titles and excerpts of the source articles. The facts come from the linked article.