The most famous breach in history wasn't a breach at all. The Greeks never scaled the walls of Troy — they were invited through the gates, wrapped inside a gift the defenders wheeled in themselves. Three thousand years later, that remains the attack pattern governance is least prepared to handle.
Microsoft CEO Satya Nadella gave it a modern name this month. His warning to companies adopting AI wasn't about a rogue model or a data leak. It was that the proprietary systems sold by the giant AI labs may be functioning as Trojan horses — dependencies embedded so deeply, and so opaquely, that you can neither see what they're doing nor unwind them if you had to. Silicon Valley spent the week debating whether he's right. Governance teams should be asking a broader question, because Nadella described only one instance of a pattern that ran through nearly every security story worth reading this week.
The threats that matter most no longer break in. They get onboarded.
You Don't Build Your Stack — You Assemble It
For most of its history, software supply-chain security focused on the center: build servers, package registries, CI/CD pipelines. As DevOps.com reported, recent attacks reveal how incomplete that picture is. The Megalodon campaign injected malicious GitHub Actions workflows and turned developer workstations into an entry point — the laptop where an engineer pulls a dependency, runs a tool, and holds credentials to nearly everything.
That shift matters because the perimeter model assumes a clean line between inside and outside. But when your build pipeline is composed of third-party actions, someone else's registry entries, and code assembled from parts you didn't write, the "outside" is already running inside your most trusted process. You didn't build that pipeline. You assembled it — and every borrowed piece carries governance you never designed.
Extensibility Is the New Attack Surface
CISA's vulnerability summary for the week of July 6 flagged MaxKB, an open-source AI assistant used inside enterprises. Versions before 2.10.0-lts carried a flaw in the tool import functionality. Read that twice: the feature that lets the assistant import and use external tools is the vulnerability.
This is the defining tension of AI adoption. Extensibility — the ability to plug in tools, connectors, and integrations — is exactly what makes an AI agent useful, and exactly what makes it dangerous. A recent arXiv survey on generative AI in cybersecurity makes the systemic version of the argument: the same large language models that accelerate defenders also generate malware and lower the skill floor for attackers. These tools are dual-use by design. You cannot import the upside without importing the downside.
The doors most organizations have quietly propped open include:
- Foundation models they can't inspect, audit, or fully explain
- Third-party CI/CD actions and workflows pulled from public registries
- Open-source AI tools whose extensibility is the whole selling point
- SaaS and cloud platforms steadily absorbing more of the stack
Concentration Is a Trojan Horse, Too
That last item points to a second, quieter version of the problem. Data Engineering Central spent the week examining Cloudflare's push to become a full data platform — the latest example of a single vendor expanding from one job into being the substrate for many. The appeal is obvious: one integration, one bill, one throat to choke.
But concentration is its own governance risk. The more of your stack a single provider holds, the more a single failure, price change, policy shift, or compromise cascades across everything you run. This is Nadella's warning in structural form. Depend on one lab's proprietary model, or one platform's data services, and you've handed a stranger a load-bearing role in your business. Consolidation reduces the number of vendors you manage while increasing the blast radius of each one. Fewer guests inside — but the ones who remain hold the keys to more rooms.
Governance's Job Is Composition, Not Perimeter
If the threat arrives as a trusted component, the governance response can't be a taller wall. It has to be a sharper guest list — and a plan for the moment a guest turns hostile.
The Justice Department just previewed the accountability side of that equation. As Corporate Compliance Insights noted, the Bosch matter is the first national-security application of the DOJ's department-wide Corporate Enforcement Policy, and it extends meaningful benefits to companies that voluntarily self-disclose, cooperate, and remediate. The lesson for composition risk is direct: when — not if — a borrowed component fails, your legal and regulatory standing depends on whether you detected the problem and disclosed it. And you cannot disclose what you never inventoried.
For governance and compliance leaders, that turns a few abstractions into concrete work:
- Maintain a living register of inherited trust. Every model, action, tool, and platform is a governance dependency — not just a procurement line item.
- Bring developer workstations into scope. The edge is now part of the supply chain, and it deserves the same policy attention as the build server.
- Treat extensibility as a control decision. Every connector, plugin, and agent tool should be an explicit, reviewed grant, not a default-on convenience.
- Model concentration deliberately. Ask what breaks — and whom you'd owe notice — if a single platform or model provider fails or rewrites its terms.
- Build the disclosure muscle before you need it, because enforcers increasingly reward the organizations that can show their work.
The Best Wall Won't Save You. The Best Guest List Might.
The perimeter didn't collapse because attackers got better at breaking in. It collapsed because we got better at inviting them — faster onboarding, deeper integrations, more helpful tools, more convenient platforms. That's not a trend anyone can reverse. Assembly is simply how modern software gets built and how AI gets adopted.
But it changes the mandate. Governance is no longer the work of keeping the outside out. It is the discipline of knowing precisely what you've let in, what it is permitted to do, and who answers for it when a gift turns hostile. The organizations that come through the next few years intact won't be the ones with the highest walls. They'll be the ones who knew exactly who — and what — was already inside.
Sources
- Vulnerability Summary for the Week of July 6, 2026 — CISA
- Bosch Case Provides First Glimpse of NatSec Application of Department-Wide CEP — Corporate Compliance Insights
- Why Developer Workstations Have Become a Critical Part of the Software Supply Chain — DevOps.com
- Cloudflare as a Data Platform? — Data Engineering Central
- Large Language Models (LLMs) and Generative AI in Cybersecurity and Privacy: A Survey of Dual-Use Risks, AI-Generated Malware, Explainability, and Defensive Strategies — arXiv — Artificial Intelligence (cs.AI)
- Satya Nadella has issued a shocking warning to companies using AI — TechCrunch