A skill file. A rules file. An MCP server configuration. Three lines of plain text, committed like documentation, reviewed like documentation, and none of them look like code. And yet each one can quietly rewrite what your AI assistant is instructed to do and what it is allowed to reach. That’s the uncomfortable truth behind AI security dalam 2026. The industry spent two years worrying about what AI-generated code contains. The harder problem turned out to be the AI supply chain itself: the models, agents, MCP servers, and configuration files that now sit alongside your source code and open-source dependencies, largely uninventoried and unreviewed. This is exactly why AI supply chain security has become its own discipline, and why choosing the right AI security company matters as much as choosing the right scanner.
The attack surface nobody budgeted for
Software used to have a handful of places an attacker could land: the code, the dependencies, the pipeline. AI added two more, and both feed directly into the AI supply chain.
The model and the agent. Tool poisoning, prompt injection, agent autonomy that goes further than anyone intended. A hidden instruction in an MCP server description can quietly redirect what a copilot does, and the developer never sees it happen.
The developer’s own environment. IDEs, AI copilots, MCP servers, agent CLIs. Invisible to legacy AppSec scanners, which don’t know what a model is, and invisible to EDR, which watches the operating system and has no idea what a dependency or an MCP call is.
None of this is theoretical. In the last eighteen months:
- A hidden-Unicode “rules file backdoor” let attackers inject invisible instructions into the configuration files Copilot and Cursor read, silently backdooring code the assistant generated. GitHub added a warning for it in 2025.
- A command-injection flaw in a popular MCP bridge (CVSS 9.6) hit over 400,000 downloads before it was fixed, the first documented case of full remote code execution triggered simply by connecting to an untrusted MCP server.
- A self-propagating npm worm turned developers themselves into the delivery mechanism, and the pattern repeated at scale in the following months across other ecosystems, a textbook AI supply chain security failure.
- Researchers found that a meaningful share of packages LLMs recommend don’t exist at all, “slopsquatted” names an attacker registers before a real developer ever asks the model to import them.
Google’s own research into securing the AI software supply chain reaches a similar conclusion from a different angle: models found circulating in 2023 and 2024 looked legitimate while carrying code that could exfiltrate data or plant a backdoor once downloaded, and the fix wasn’t a new category of tool so much as applying supply-chain discipline, like provenance and signing, to artifacts nobody had been tracking before. That’s the AI supply chain security problem in one sentence: the artifacts are new, but the discipline they need isn’t.
Why your existing tools stop short
SAST reads code. SCA reads a manifest of dependencies. Neither one knows what a model is, what an MCP server exposes, or what a skill file instructs an agent to do. That gap is exactly where AI-era attacks land, in the space between “code we scan” and “AI we quietly adopted.”
The result is a category of shadow AI no CISO can currently answer for: what models are we running, which agents can reach what, and which MCP server did someone connect last Tuesday without telling anyone. Answering that question well is the job of AI supply chain security, and it’s the reason generic AppSec tooling keeps falling short here.
What AI security actually means
Xygeni is the AI security company that treats this as three connected motions across the SDLC: discover, detect, and enforce.
Discover: know what AI you actually have
Continuous, automatic discovery across your repositories surfaces every AI asset: models, frameworks, datasets, inference endpoints, agents, MCP servers, skills, prompts, guardrails, and the AI coding tools your developers are actually using. No surveys. No self-reporting. If it left a trace in a repository, it shows up in the inventory, the first and most basic requirement of real AI supply chain security.
The AI graph then maps how those assets connect: which model a dataset feeds, which agent invokes which tool, which MCP server sits behind which assistant. An asset in isolation tells you little. The graph shows you where the risk concentrates.
From that same discovery, Xygeni generates an AI-BOM: an audit-ready, machine-readable inventory of everything AI-related in your software. When a regulator, an auditor, or a customer asks what AI you’re running, the answer becomes a download instead of a three-week scramble.
Detect: the risks conventional scanners can’t see
A dedicated AI scanner looks for the failure modes that are specific to AI systems: prompt injection, tool injection and untrusted tool invocation, data leakage through retrieval, system prompt bypass, excessive agency. Every finding maps to the 10 Teratas OWASP untuk Aplikasi LLM and points to the exact file and line that creates the exposure, not a vague “review your AI usage” alert.
The same detection layer treats skill files, rules files, and MCP configurations as the security artifacts they are, not as harmless documentation. It flags malicious or poisoned skills, inspects MCP server configurations for tool poisoning, and surfaces the prompts actually driving your AI workloads.
Prioritize: the funnel that cuts noise, not corners
Every finding gets filtered progressively: down to what’s reachable in application code, then to what’s genuinely exploitable, then to what sits in code your team is actively developing. What reaches a developer’s queue is the short list that actually threatens production, with the framework reference, the exposure window, and mitigation guidance attached.
Enforce: stop it before it runs
Shield brings policy enforcement to the developer’s own endpoint: it blocks unauthorized and malicious installs, unapproved models, and unsanctioned MCP servers before anything executes. Underneath it sits Xygeni’s Amaran Awal Perisian Hasad (MEW), which catches malicious packages before a signature exists, the layer reputation-based tools still trust because nobody has reported the package yet. It’s the enforcement half of AI supply chain security: discovery and detection tell you what’s wrong, Shield is what actually stops it.
Your AI exposure isn’t only in your AI code
A complete AI supply chain security picture needs more than a model inventory, and it’s rarely just the flashy stuff:
- Kelayakan penyedia AI left in prompt files, agent configs, or pipeline logs are secrets like any other, and Xygeni’s secrets detection catches them before they reach a public registry.
- Kebergantungan AI dan ML yang terdedah carry ordinary CVEs, surfaced by the same software composition analysis that already covers the rest of your stack. Third-party research on AI adoption has pointed to how much of the modern AI stack is externally sourced packages and hidden components, which is exactly the surface software composition analysis was built to cover.
- Pakej berniat jahat published faster than any advisory pipeline can catalog them are caught pre-signature, the same MEW capability protecting the rest of your supply chain.
The agentic layer: DevAI and CoreAI
Discovery and detection cover what’s already in your repositories. DevAI works where the risk is created: inside the IDE, as a continuous, proactive layer that scans human and AI-generated code as it’s written, no prompts required. It explains the full exploit path behind a finding and proposes MCP-validated fixes a developer can apply with confidence, without breaking the build.
CoreAI sits above the individual scanners as the intelligence layer: it correlates code, dependency, pipeline, and posture data into one risk model, answers questions in natural language, and produces the executive-ready reporting a security leader needs to show governance is actually happening, not just claimed.
Extend what you have in AI Security. Don’t rip anything out
The most common objection to a new security category is “we already have enough tools.” As an AI security company, Xygeni doesn’t ask you to replace anything: the same triage, explanation, and prioritization applied to its own findings runs equally on findings from your existing SAST, SCA, and third-party scanners. Your current stack becomes an input, not a casualty, and your AI supply chain security posture improves without a rip-and-replace project attached to it.
Why this matters now, not later
Regulators are converging on the same expectation from different directions: the EU AI Act, NIS2, and Spain’s ENS all push toward inventory and traceability for AI systems, the same evidence an AI-BOM is built to produce. The direction of travel is clear even where the exact compliance mechanics are still settling: you cannot attest to AI you have never inventoried, and you cannot claim AI supply chain security if the supply chain itself is invisible to you.
Choosing an AI security company
Not every AI security company draws its boundary in the same place. Some stop at scanning your own AI-generated code. Others stop at the endpoint. The AI supply chain security question is bigger than either slice on its own: it spans the model, the agent, the MCP server, the skill file, and the ordinary dependency sitting underneath all of it. That full-lifecycle view, from discovery through enforcement, in one console with the rest of your AppSec findings, is what to look for when you evaluate an AI security company rather than a single point tool.
The files nobody reviews became the way in. AI security is the discipline of reviewing them, and AI supply chain security is what makes that discipline hold up end to end, on the same platform where you already review everything else.
See what your AI is actually allowed to do. Mulakan percuma or jadualkan demo.
Soalan Lazim
Does Xygeni’s code ever leave my infrastructure?
No. Scans run inside your own environment, and source code is never uploaded to Xygeni’s servers. The AI inventory and AI-BOM are built from what the scanner sees locally, not from a copy sent externally.
What’s the difference between AI Security, DevAI, and CoreAI?
AI Security discovers and detects: it builds the AI inventory, the AI-BOM, and finds risks like prompt injection or poisoned skill files. DevAI works inside the IDE as developers write code, proposing fixes as they go. CoreAI sits above both, correlating findings across the whole platform and answering questions about your security posture in natural language.
Which AI security frameworks does Xygeni align with?
Findings map to the OWASP Top 10 for LLM Applications, the OWASP Top 10 for MCP, and the OWASP Top 10 for Agentic Skills, alongside NIST SP 800-218A and CISA/G7 guidance on AI bills of materials. That mapping is what makes the AI-BOM usable as compliance evidence rather than just an inventory.
Will this flag every AI library or model as a risk?
No. The prioritization funnel narrows findings down to what’s reachable in application code, genuinely exploitable, and in active development, so the list a developer sees is short, not a dump of every AI asset detected.
