AI coding helpers now act like outside vendors, and few firms vet them

AI coding helpers such as Claude Code, Codex and Cursor are being installed like cheap software seats, but they act like outside contractors with deep access. A CIO column argues that few companies check them that way. In one case at a Fortune 100 bank, an agent read a file holding live database passwords before the developer typed anything.

What happened at the bank

The agent opened a routine session on a payments service and read the whole project, including a file with production database credentials. Those passwords entered the agent's working memory, potentially exposing them to an AI provider the bank had never assessed. Nothing malicious happened. The tool did what it was built to do. Whether the passwords left the bank depended on controls nobody had verified.

Why it counts as a supplier

These tools can read code, find passwords, run other tools and reach the internet. They also depend on other parties: model providers, plugin stores and connected servers. Any of those can be sold, hacked or switched off. Cursor shows how. On Aug. 28, OpenAI told SpaceX, Cursor's new owner, that it plans to stop supplying models to Cursor, with Nov. 12 proposed as the cutoff. Cursor's CEO said OpenAI models carry about 5 percent of its traffic.

The numbers and the attacks

• IBM found unapproved AI tools in 43 percent of breaches studied, more than double the prior year.
• Of organizations with AI-related breaches, 92 percent lacked proper AI access controls, per IBM.
• Verizon's 2026 report ties third parties to 48 percent of breaches.
• The average breach now costs $4.99 million, a record, per IBM.

Attackers are using these seams. Plugin4Shell, reported Sept. 18, is a flaw that lets an attacker run code with no click from the user. It affected plugin systems in Codex, Claude Code, Gemini CLI and Copilot. Anthropic and OpenAI have patched. GitHub's fix was reported as incomplete at disclosure, and Google retired Gemini CLI instead of patching it.

What to do

The column names four controls that companies should apply to any privileged supplier:

• Review vendor terms and the outside services behind each tool.
• Limit the passwords and secrets the tool can see.
• Approve the servers and plugins it connects to.
• Restrict where it can send data.

The author says the failure falls between teams. Purchasing saw a low-cost seat, security reviewed the vendor but not what sits behind it, and engineers saw a productivity tool. Few rules name coding agents directly, but existing third-party risk rules can apply, depending on the company and how the tool is used.