We have long recognized that developer environments represent a weak point in the software supply chain. Jim Gumbley and Lilly Ryan explore how agentic coding assistants expand the attack surface of software supply chains and what measures we need to do to safeguard security when using them.