Supply Chain Attacks Hit AI Pipelines and Runtime Governance Races to Catch Up

Security

Axios Supply Chain Attack Reached OpenAI's macOS Signing Pipeline, Forced Certificate Rotation

A malicious Axios npm package made it far enough into OpenAI's CI to force a full signing certificate rotation. This is exactly the kind of downstream blast radius that makes supply chain security in AI pipelines non-negotiable right now.

Analysis

Socket's Deep Dive: Where Microsoft's Agent Governance Toolkit Falls Short on Credentials

Socket's analysis goes past the feature list and flags the real gap: the toolkit doesn't enforce least-privilege per-task credentials, and the semantic intent classifier has no independent red-team validation yet. If you're evaluating this for production, read this before deploying.

Agent Governance Toolkit Still in Public Preview with No Stable v1.0 Roadmap Published

This writeup flags three blockers worth knowing: sample configs are not hardened for production, the intent classifier benchmark results are internal only, and there's no published timeline to stable GA. Teams in regulated industries should treat this as experimental for now.

Tools

Microsoft Agent Governance Toolkit: Seven-Package Runtime Security System Now Available

Help Net Security breaks down the full seven-package architecture, framework integrations, and deployment options for teams on Azure. Good reference piece if you want the practical install path without wading through the full GitHub repo.

Microsoft's Agent Governance Toolkit: The OS Kernel Mental Model for Autonomous Agents

Microsoft frames the toolkit as doing for agents what kernels did for processes and service meshes did for microservices. The analogy is useful and the OWASP Top 10 coverage is deterministic rather than probabilistic, which is the right call for anything touching production infrastructure.