Editor extensions auto-update and run with developer privileges, yet they often fall outside software inventory. The Markdown Preview Enhanced research shows why they belong in supply-chain security governance.

The keyv/cacheable investigation is a reminder that a compromised npm dependency can spread through transitive resolution, not just direct imports. Teams need to scope exposure from build evidence and deployed artifacts.

Wiz argues that AI changes the context around data risk: organizations need to understand what data is connected, exposed, and why. That understanding is a prerequisite for trustworthy agents, response, and remediation.

Wiz says Wiz Workflows is generally available and Remediation and Response is in public preview. The direction moves security beyond isolated alerts toward detection, decision, execution, and verification.

AgentCore Gateway supports OAuth 2.0, IAM, and API keys, yet enterprises may still depend on HTTP Basic Authentication. AWS describes a request Lambda interceptor as an extension point for custom and legacy tool authentication.

An AI agent that accesses enterprise data should not act only through a shared service identity. AWS describes propagating user authorization context so an agent returns data according to the requester’s permissions.

As AI and third-party software operate on developer machines, workstations can hold direct paths to source code, credentials, and cloud environments. Wiz is framing the developer endpoint as a security perimeter that needs dedicated attention.

Wiz CIRT’s multi-organization campaign lessons frame GitHub PAT compromise as an identity investigation. Effective response connects a token to its owner, repository access, API activity, and downstream privileges.