Eight months. Four major incidents. One pattern: the software supply chain didn’t get a new adversary, it got a new weapon. Between September 2025 and May 2026, a self-propagating worm, a nation-state actor, a copycat campaign, and a hijacked AI model each found their way into pipelines that millions of developers trust every day. This is the new shape of cybersecurity threats: faster, harder to see, and increasingly powered by the same AI that development teams use to ship code.
If your mental model of cybersecurity threats still starts and ends with phishing emails and unpatched servers, the data below will update it.
The New Shape of Cybersecurity Threats
For years, cybersecurity threats meant stolen credentials, misconfigured servers, and social engineering. Those risks haven’t disappeared: 81% of confirmed data breaches in 2022 involved compromised credentials. But a new category has moved to the center of the conversation: AI threats. Development teams now rely on AI coding assistants, agentic copilots, and Itifaki ya Muktadha wa Mfano (MCP) servers to build software faster, and each of those is now also a target. Research shows that around 40% of AI-generated code contains security vulnerabilities, which means the speed AI promises comes bundled with a proportional rise in AI security risks baked directly into the codebase.
Eight Months, Four Incidents: How AI Threats Escalated
The clearest evidence that AI threats are accelerating isn’t a forecast; it’s a timeline of what already happened:
- September 2025, Shai-Hulud: the first self-propagating npm worm, turning developers themselves into a delivery mechanism.
- March 2026, axios: nation-state malware hidden inside a package pulled roughly 100 million times a week.
- April 2026, SAP npm: a smaller-scale repeat of the same worm pattern, showing the technique scales.
- May 2026, Claude Opus → PromptMink: a large language model weaponized to plant malware inside an autonomous agent, with AI itself acting as the attack vector.
Each incident reused and scaled the one before it. That’s the defining feature of AI threats in 2026: they compound faster than traditional cybersecurity threats ever did, because the same automation that helps developers ship also helps attackers propagate.
Why Traditional Tools Can’t See These AI Risks
Traditional AppSec tools stop at the repository and don’t know what a model is. Traditional endpoint tools watch the operating system and don’t understand packages, MCP servers, or AI assistants. That gap between the two is exactly where AI risks land, undetected, until the damage is done.
Two figures make the exposure concrete: AI-targeted credential theft increased 376% between Q4 2025 and Q1 2026, and a single malicious MCP bridge (CVE-2025-6514) was downloaded 437,000 times before it was caught, enabling remote code execution on the client. Public MCP servers aren’t safe by default either: 5.5% carry tool-poisoning flaws and 43% carry command-injection flaws severe enough to turn a developer’s own tooling into one of the more serious cybersecurity threats an organization can face.
The Software Supply Chain Is Still the Biggest Source of Cybersecurity Threats
AI didn’t invent this problem, it extended it. The software supply chain was already the most exploited entry point for cybersecurity threats, and the numbers back that up. More than 778,500 malicious open-source packages have been identified since 2019, and that figure surged 156% in a single year to reach 512,847 packages. ENISA has found that 60% of supply chain attacks took advantage of customer trust in a supplier, and by some estimates the software supply chain now experiences an attack roughly every 48 hours. Supply chain attacks rose 742% between 2019 and 2022, with projections suggesting 45% of organizations will be affected by 2025 and annual costs reaching $138 billion by 2031; the cost of software supply chain attacks this year alone is estimated at $60 billion.
The same dependency and pipeline weaknesses that created these classic cybersecurity threats now also carry AI risks: a compromised package, a misconfigured GitHub Action, or an unpinned CI/CD step can target an AI agent just as easily as a human developer.
Broader AI Security Risks Beyond the Codebase
Not every AI risk lives inside a code file. A fuller map of AI security risks spans the whole lifecycle of an AI asset: prompt injection and system-prompt leakage, sensitive data exposed through overly permissive AI configurations, poisoned vectors and embeddings, malicious instructions hidden inside documents and rule files, insecure MCP configurations and untrusted servers, vulnerable or slopsquatted AI dependencies, and excessive agency, where an AI agent acts beyond the boundaries it was configured with.
These categories map directly onto the OWASP Top 10 for LLM applications, OWASP Top 10 for agentic applications, Na 10 Bora za MCP za OWASP, three frameworks quickly becoming the shared vocabulary for AI security risks across the industry.
Reducing Exposure to Cybersecurity Threats: What Actually Works
The data points to two things that consistently work against cybersecurity threats: basic hygiene and early detection. 98% of cyberattacks are prevented with basic security hygiene, yet 34% of data breaches still stem from insider threats, and 60% of applications still contain vulnerabilities in first-party code. GitHub itself isn’t immune: 1.9% of GitHub proof-of-concept exploit repositories are themselves malicious, built to exfiltrate data or deploy malware to the researchers who trust them.
For AI risks specifically, the fix has to move earlier in the lifecycle:
- Validate inside the IDE. Catching insecure patterns in AI-generated code before it ever reaches a pipeline closes the biggest single source of new AI security risks.
- Detect malware before a signature exists. Reputation-based tools miss zero-day packages by definition, which is exactly the gap Shai-Hulud, axios, and SAP npm exploited.
- Inventory every AI asset. Models, datasets, agents, and MCP servers can’t be governed, or attacked through, something a team doesn’t know it’s running.
How Xygeni Addresses These Cybersecurity Threats
Xygeni treats AI threats as a first-class part of application security rather than a separate problem bolted on afterward. DevAI applies real-time security validation inside the developer’s IDE, flagging insecure patterns in AI-generated code before they ship. Malware Early Warning (MEW) continuously scans NPM, PyPI, and Maven to catch malicious packages before a signature exists, addressing the exact supply chain pattern behind Shai-Hulud, axios, and SAP npm. AI Security discovers every AI asset across the SDLC, scores it against the OWASP frameworks above, and Shield enforces policy at the endpoint before an unsafe model, agent, or MCP server is allowed to run.
The organizations managing AI risks well in 2026 aren’t the ones running the most tools. They’re the ones who can see every AI asset they run, stop what’s unsafe before it executes, and apply that intelligence to the tools they already own.
Maswali
What are the biggest cybersecurity threats in 2026?
Supply chain attacks remain the largest category by volume and cost, with an estimated $60 billion in damage this year and an attack roughly every 48 hours. Alongside them, AI threats have emerged as a fast-growing category: AI-targeted credential theft rose 376% in a single quarter, and incidents like Shai-Hulud, axios, and PromptMink show attackers actively using AI as both a target and a delivery mechanism.
Is AI-generated code a security risk?
Yes. Research shows around 40% of AI-generated code contains security vulnerabilities. That makes real-time validation inside the developer’s IDE, before code merges, one of the most effective ways to reduce AI security risks at the source.
What is MEW and how does it address AI threats?
Malware Early Warning (MEW) is Xygeni’s continuous scanning system for NPM, PyPI, and Maven. It’s designed to catch malicious packages before a signature exists, which matters because reputation-based tools only catch what’s already been identified, missing the exact zero-day pattern behind recent AI threats and supply chain worms.
Are MCP servers a real source of AI risks?
Yes. Public MCP servers show measurable AI security risks in the wild: 5.5% carry tool-poisoning flaws and 43% carry command-injection flaws, and one compromised MCP bridge alone was downloaded 437,000 times before detection.
