Chainguard CISO: AI agents rewrite software supply chain security rules

Chainguard CISO Quincy Castro says AI agents now pick application dependencies themselves, while attackers use frontier models to chain minor flaws into viable attack paths. GitHub handles roughly 275 million commits a week, and mean time-to-exploit has fallen from 63 days in 2018–19 to an estimated minus seven days in 2025.

• GitHub processed about 275 million commits per week by April 2026
• GitHub Actions grew from 500 million to 2.1 billion compute minutes weekly
• Mean time-to-exploit fell from 63 days to minus 7 days
• The TeamPCP campaign compromised Trivy and other open source projects