The supply chain is the target: backdoored extensions, poisoned weights, and agents with the keys

In one week, the AI supply chain failed at every layer: a tampered Claude Code extension reached up to 5,000 Cursor users under Anthropic's real publisher ID, researchers showed 0.1% poisoned training data plants a working backdoor in an agent, and attackers' own agents went from a GitHub search to an emptied Key Vault in five minutes. The prompt is no longer the trust boundary — the supply chain is.