Case study · Developer and AI supply-chain security

Fast tools, short leashes: securing AI coding assistants and developer machines at a UAE software house

A software house in the UAE built systems for banks and government entities, and its engineers had adopted AI coding assistants, AI-native editors and a long tail of extensions. Then October 2026 showed how attackers use exactly those tools: a backdoored coding extension in an editor marketplace, and a run of breaches at AI developer platforms feeding a market in stolen model keys. The firm needed to keep the productivity and remove the blast radius.

Case studySoftware services · UAESumanta Mukhopadhyay9 min read
#security#ai#platform
Book a 30-min call → Analyse your challenge
CASE STUDY · CASE STUDY · DEVELOPER AND AI SUPPLY-CHAIN SECURITY1 Nov 2026 · 15:55 GST
At a glance
SectorSoftware services · UAE
My roleFractional CTO and principal architect
EngagementAssessment, architecture and delivery leadership
ScopeDeveloper endpoints, editor extensions, AI assistant access, API key management, CI/CD signing, client environment isolation
What changed
  • Editor extensions installed only from an approved, mirrored list
  • No long-lived production or client credentials on developer laptops
  • All AI model access through one gateway with per-team keys, limits and logs
  • Only signed, verified builds admitted to client environments
  • A rehearsed playbook for a compromised developer tool
Managed developer endpointsExtension allow-list and private mirrorAI gateway for model accessSecrets manager with short-lived credentialsSigned builds and admission policyIsolated client environmentsEndpoint detectionInfrastructure as code

Anonymised composite. Client names, identifying details and confidential figures are withheld; public facts are cited in the references.

The situation

A software house based in the UAE built and ran systems for banks, insurers and government entities across the Gulf. Its engineers had embraced AI: coding assistants in their editors, AI-native editors with their own extension marketplaces, hosted AI development platforms for experiments, and personal API keys for several model providers. Developers had local admin rights, long-lived cloud credentials and, in some cases, access to client environments from their laptops.

Why now. October 2026 made the risk concrete. On 29 October, tampered versions of the Claude Code extension were listed in Cursor's extension marketplace for a few hours; Microsoft's analysis describes a loader that tried to add an attacker SSH key and open a reverse tunnel on developer machines12. Days earlier, a Wiz Research report described a month of breaches at AI developer platforms, with stolen AI credentials feeding LLMjacking, the resale of model access3. For a firm whose clients sit under the UAE's tightening expectations on cyber resilience and supply-chain security4, "a developer's editor was compromised" could not be allowed to mean "a client was compromised".

What had to be true

  • Only approved extensions and tools on developer machines, updated deliberately rather than automatically.
  • No long-lived secrets on laptops: nothing on a developer machine that can reach production or a client on its own.
  • One governed route to AI models, with per-team keys, limits and logs.
  • Only verified builds reach client environments.
  • Productivity kept: engineers still use AI assistants every day.

Architecture

Developer machine
Managed endpointno standing admin, EDRApproved extensionsfrom a private mirror
AI access
AI gatewayper-team keys, limits, logsApproved modelsby data classification
Identity and secrets
Short-lived credentialsissued on demandSecrets managerno keys in repos or env files
Build
CI runnersisolated, ephemeralSigned artefactsprovenance recorded
Client environments
Admission policysigned images onlySeparate per clientno shared credentials
Each layer assumes the one above it might be compromised.

The data flow, end to end

  1. CodeAn engineer writes code with an AI assistant on a managed machine
  2. AskAssistant calls go through the AI gateway with the team's key, not a personal one
  3. CommitCode is pushed; secrets scanning blocks any credential in the change
  4. BuildEphemeral CI builds, signs the artefact and records its provenance
  5. AdmitThe client environment admits only artefacts with a valid signature
  6. OperateProduction access is granted just in time, never from standing laptop credentials
A compromised laptop can affect code, which review and signing catch; it cannot reach a client directly.

The hard part: controlling extensions without killing productivity

Extensions are the riskiest software on a developer's machine: they run with the user's rights, auto-update silently and can come from marketplaces the company does not control. The Cursor incident showed that even a well-known extension name is not a guarantee, and that auto-update can push a tampered build to thousands of machines in hours2.

Banning extensions would have failed; engineers would have worked around it. Instead the team built a private mirror. Approved extensions are pulled, scanned and pinned to a version; editors are configured to install only from the mirror; and updates are promoted after a short delay and a check of the publisher's security notices. Requests for new extensions go through a lightweight review with a target turnaround, so the approved list grows with real needs.

The second control was removing what a compromised extension could steal. Long-lived cloud keys, client VPN profiles and personal model API keys were taken off laptops. Developers get short-lived credentials for the task at hand, and AI calls use the gateway, so a stolen key from a laptop or a third-party platform is limited by the gateway's quotas and visible in its logs. See AI coding policy for engineering teams and keeping secrets out of state.

Assume one developer tool will be compromised. Design so that the worst it can do is change code that review and signing will catch, not reach a client or spend unlimited money.

The last line: only verified builds reach clients

Even with good endpoint controls, code can be tampered with. The final check sits at the client environment: only container images signed by the firm's CI, with recorded provenance, are admitted. Kubernetes supports this pattern through admission policies that validate image signatures before a pod is allowed to run5.

Flowchart: create a policy instance and annotate the namespace to validate signatures, create a pod, run policy evaluation, then admit the pod and pull the image if it passes or refuse admission if it fails
Signature verification at admission: unsigned or tampered images never start. Source: Kubernetes blog, Sascha Grunert · CC BY 4.0

How it ran

Security
  1. Incident triage
  2. Extension review
  3. Detection rules
Platform engineering
  1. Private mirror
  2. AI gateway and secrets
  3. Signing and admission
Engineering leads
  1. Extension requests
  2. Team AI budgets
  3. Adoption and feedback
Security set the rules, platform made them easy, engineering leads kept them practical.
Week 1Contain
  • Check for known indicators
  • Rotate exposed keys
  • Disable auto-update
Weeks 2 to 4Mirror and gateway
  • Approved extension list
  • AI gateway
  • Team keys and limits
Weeks 5 to 8Remove secrets
  • Short-lived credentials
  • Client access just in time
  • Secrets scanning
Weeks 9 to 12Verify
  • Signed builds
  • Admission policies
  • Compromised-tool drill
Contain the immediate risk in week one; build the lasting controls over a quarter.

Key decisions and trade-offs

DecisionAlternativeWhy
Private extension mirrorBan extensions or allow anyKeeps productivity, removes silent updates
AI access through a gatewayPersonal API keysLimits, logs and quick revocation
Short-lived credentialsLong-lived keys on laptopsStolen credentials expire before they are useful
Signed builds and admission checksTrust the CI pipelineTampered code cannot reach clients unnoticed
Separate access per clientShared credentials across clientsOne incident cannot spread between clients

What I'd do again, and differently

Again: give engineers a fast path to request tools. The mirror only works if it says yes quickly to reasonable requests. Differently: put the AI gateway in place before AI tools spread, not after. Personal keys scattered across laptops and platforms were the slowest thing to clean up. Related: the 1 November tech news, the Binance hack: architecture lessons, hardening a utility's management plane and the UAE page.

If your teams use AI coding tools and serve regulated clients, see my fractional CTO work, or analyse your challenge and bring the result to a call.

References
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
FAQ

Common questions

What happened with the malicious Claude Code extension?

Cursor reported that tampered versions of the Claude Code extension were listed in its marketplace for a few hours on 29 October 2026. Microsoft's analysis describes a loader that tried to plant an SSH key and open a reverse tunnel. Anthropic said its own systems were not compromised.

What is LLMjacking and why does it matter to software companies?

LLMjacking is the theft and resale of access to AI models, usually through stolen API keys or cloud credentials. Keys stored in developer platforms, laptops or CI systems can be used to run large volumes of model calls at the victim's expense.

Do we need to ban AI coding tools?

No. The aim is to control what they can reach: approved extensions only, no long-lived secrets on laptops, model access through a gateway with limits, and verified builds before anything reaches a client.

Keep reading

Related

ServiceFractional CTO in the UAEI work with founders, enterprises and investors across the UAE and the Gulf on AI, data and technology leadership, with an eye on local data-protection rules and residency from day one.→ServiceFractional CTOI work as a part-time CTO for founders, CEOs and boards who need experienced technical judgement now, and a team that can carry it on after I step back.→ServiceAI & LLM architectureI design and build AI systems that leadership can trust: grounded in your data, measured by evaluations, governed by your rules and priced so they make sense at scale.→InsightTech news, 2 November 2026: the FBI names the Binance attacker, a vendor script drains Polymarket traders, a CVSS 10 LXD flaw and Aramco buys into HUMAINA weekend dominated by follow-through on October's security stories: an official attribution for the Binance theft, a reminder that one third-party script can empty user accounts, and a maximum-severity flaw in a widely used container and VM manager. In the Gulf, Saudi Arabia consolidated its national AI champion.→
Open to advisory, fractional CTO & select builds

Let's talk about what you're building.

The fastest route is a free 30-minute call. Prefer to write? Send a message and I'll reply personally within two business days.

Book a 30-min call → Send a message or analyse your challenge first →
Start a conversation

How would you like to reach me?

Book a 30-min callFastest. Pick any open slot on my calendar.→ Write in GmailOpens a pre-filled draft in your browser.→ Use my email appOutlook, Apple Mail or your default client.→

I reply personally within two business days. Time zones from the Americas and Europe to the Middle East and Asia-Pacific.