AI Agent Supply Chains Face Rising Attacks as CVE Scanners Miss Most Threats

·1 views

A backdoored version of LiteLLM, a widely used model gateway underlying frameworks like CrewAI and DSPy, was available on PyPI for roughly three hours in March and was downloaded approximately 47,000 times before removal. Security researchers documented eight major AI-related incidents between January and mid-April 2026, yet only one received a CVE designation, meaning standard scanning tools like Dependabot and Snyk would have missed the majority. Attackers are increasingly targeting trusted components in agent ecosystems — including MCP servers, dependency packages, and data sources — rather than exploiting code written by developers directly. Notable cases include a Model Context Protocol server that shipped 15 clean versions before introducing exfiltration code, and a Cursor vulnerability that turned allowlisted commands into payload delivery mechanisms. Security experts recommend pinning dependency versions, delaying adoption of new agent-ecosystem releases by at least seven days, and vetting MCP servers with the same scrutiny applied to third-party code integrations.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds CSS-only rotisserie animation with no SVG or images

A frontend developer created a pure CSS art piece depicting nine chickens rotating over a tandoor fire as part of DEV Community's Frontend Challenge: Comfort Food Edition. The entire scene — birds, flames, plated dish, and cabinet — is built using only divs, gradients, and shadows, with no SVG or image files. Rather than rotating the bird shapes, the developer simulates rotation by scrolling a repeating char-pattern gradient vertically inside a fixed silhouette, achieving a seamless loop. Significant effort went into making each chicken readable, with overlapping body parts and strategically darkened drumstick ankles creating a three-dimensional appearance without any 3D CSS. The piece also animates a bird being removed from the spit and served on a plate, complete with onion rings, mint chutney, and coriander.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Analyst Scans 1,416 Reddit Threads to Surface 8 Business Ideas Backed by Data

A developer who runs a database scanning entrepreneur subreddits for pain points reviewed 1,416 threads to identify viable business opportunities supported by real search volume and competitor weaknesses. Among the top findings was a payment reminder tool tailored for trade contractors, inspired by a Reddit post where a plumber reported $47,000 in unpaid invoices due to inconsistent follow-ups. Another idea involved a family digital vault for storing passwords and financial documents, designed to grant access to a trusted person upon death or inactivity, addressing gaps left by costly and unreliable existing services. Each idea was evaluated against three criteria: a sourced Reddit thread, monthly search volume with year-over-year growth, and a specific failure point of the current market leader. The analysis also flagged practical challenges for each concept, such as SMS compliance hurdles for the contractor reminder tool and encryption requirements for the digital vault.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Login Authentication Works: From Browser Click to Server Verification

When a user clicks 'Login', the browser sends their credentials via an HTTP POST request to a backend API endpoint over HTTPS, keeping the data encrypted in transit. The backend first validates the input before querying the database to check whether an account with the provided email exists. Passwords are never stored in plain text; instead, databases hold hashed versions of passwords for security. The server then compares the submitted password against the stored hash to verify the user's identity. If verification succeeds, the backend issues a session or token, which the browser uses to maintain the logged-in state for subsequent requests.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agents Can Spend Your Money Wrong — Your Card Type Decides Who Pays

AI agents embedded in browsers and apps can now make purchases on behalf of users, but existing consumer protection laws were not written with autonomous software in mind. In the US, debit transactions fall under Regulation E, which hinges on whether a transfer was 'authorized' — a question that remains legally unresolved when an AI acts outside a user's precise intent. Credit cards, governed by the Truth in Lending Act and Regulation Z, offer broader protections, including a dispute right for goods not accepted or not delivered as agreed, without requiring proof of fraud. As of mid-2026, regulators have not issued clear guidance on AI-driven transaction disputes, despite industry calls for clarity from groups like the Consumer Bankers Association. In most erroneous agent-purchase cases, financial liability ultimately falls on the merchant, making accurate transaction record-keeping increasingly important for sellers.

0 comments Read more at DEV Community