The Toolchain Is the Target: Securing Software Development in the Agentic Era

For most of my career, software supply chain security meant scrutinizing what developers pull in: dependencies, base images, third-party packages.  That framing is now dangerously incomplete.  Over the past year, attackers moved upstream, past the packages and into the tools developers use to write code in the first place.  IDE extensions, AI...