JFrog Ltd., the Liquid Software company and creators of the JFrog Software Supply Chain Platform, the system of record for trusted software artefacts, binaries, and AI assets, announced the findings of its 2026 Software Supply Chain Security State of the Union report. This year’s report reveals an unprecedented acceleration in enterprise software risk as threat actors expand strikes beyond traditional package registries into AI model registries and developer tooling, creating a blind spot in current software governance frameworks.

"Every enterprise is adding AI to their software supply chain, which is increasing the attack surface for bad actors. Our report shows attackers are no longer just breaching traditional defences – they are actively weaponising the trusted models, registries, and agentic tools driving today's AI-powered development. The era of 'scan and hope' is over,” said Shlomi Ben Haim, CEO & Co-Founder, JFrog. “Organisations need a single source of truth that governs every binary, every model, and every AI agent skill from the moment it enters the pipeline to the moment it is deployed in production. This is what JFrog was built to deliver.”

As AI moves from experimentation to a structural force reshaping the software supply chain, organisations are seeing a widening gap between reported security confidence and the risks accumulating in their infrastructure. Drawing on data from 18.2 billion artefacts managed across the JFrog Platform (up 136 per cent year‑over‑year), original vulnerability research by the JFrog Security Research team, and a global survey of 1,508 security and DevOps professionals, this report exposes what it calls the “illusion of mastery”, i.e. the growing disparity between perceived security and the reality of mounting supply chain risk.

Key Findings Include:

Malicious Packages Hit an All-Time High: Malicious npm packages surged 451 per cent year-over-year, with 177K new malicious packages detected across registries in the last year. Attackers are exploiting trust at scale – the “Qix” campaign used just 25 packages to compromise over 2.5 million downloads.

AI Agent Skills Emerge as a New Attack Surface: For the first time, JFrog tracked malicious AI agent skills – identifying 969 carrying high-impact payloads alongside 495 malicious AI models on Hugging Face and 56 malicious extensions on OpenVSX. Attackers are no longer just targeting code; they are targeting the autonomous tools that write, review, and deploy it.

Cutting through the Noise: Vulnerabilities Are Surging, and Severity Scores Are Misleading: Over 48,000 new CVEs were disclosed in 2025, a 20 per cent year-over-year increase partially driven by AI-generated code reintroducing decades-old weaknesses, like Injection (CWE-74), which grew 3,110 per cent. Yet the JFrog Security Research team found that 66% of CVEs analysed had minimal real-world applicability: volume-based triage is noise, while context and applicability become the mission-critical signals.

The Fastest-Growing Threats Are the Least Defended: Only 40 per cent of organisations have adopted malicious package detection and secrets detection is active at just 28 per cent. The categories growing fastest in threat volume remain the least covered by existing tooling.

Security Teams Bear the Human Cost of AI: 45 per cent of respondents say reviewing and hardening AI-generated code is now a major time drain – proving that AI hasn't eliminated work – it’s merely shifted the burden as threat actors weaponise upstream developer environments and agentic tools.

The AI Governance Gap: 97 per cent of organisations claim they have certified model governance – yet 53 per cent self-host models from sources where malicious payloads have been detected, and 18 per cent have zero governance over their integrated development environments (IDE) or Model Context Protocol (MCP) servers sitting inside their developers’ workflows. Thus, the gap between reported executive confidence and actual control is widening as AI development accelerates.