Before you run the update, let an agent check it

Attackers have learned something about how software gets built. They no longer need to break into a company directly. It is easier to tamper with a tool the company's developers already trust, and let the next routine update carry the damage in.

This is now happening constantly. One security firm that tracks these incidents counted 56 confirmed cases of popular open-source software being turned malicious in the past year, with most of them since February, roughly one every three days. The targets have shifted too. The tools being poisoned are increasingly the AI coding assistants that developers run all day on machines full of passwords, keys, and access to company systems. Even the newer safeguards are not a guarantee. Official "this was built by the real publisher" stamps have been defeated more than once this year, and in October researchers showed that a widely used publishing system had been trusting a name that could be reassigned to someone else.

Meanwhile, most people still install updates the way they always have. A prompt appears, they click it, and whatever is inside runs on their machine. That moment of trust is the attack surface.

So before installing a new release of an AI coding tool we rely on, we asked an agent to check it first. Here is what that looked like.

The job: confirm the update is what it claims to be

The Agent Anything agent worked in a sealed-off workspace with nothing in it. No passwords, no project files, no connection to the computer that would eventually run the update. It could reach the internet to collect the release, and then that door was closed while it inspected what it had collected. At no point did it run the software it was examining.

Its assignment was plain. Is this release what the publisher says it is? Do the copies available from different places agree with each other? Does the install process do anything beyond what it is supposed to do? And what is the safest way to put it on a real machine?

What the Agent found

The update itself checked out. The files matched what the software distributor had recorded. The copies distributed through two separate channels were identical, which rules out one of the common tricks where one channel is quietly swapped and the other left clean. The changes since the previous version were what the release notes said they were. And the publisher's own build process showed the expected signing and verification steps had run.

The weak point was not the update. It was the way the tool installs itself. The built-in "update now" path fetches instructions from a website and follows them without checking whether the file it downloads is the one the publisher actually published. On the day we looked, those instructions were honest. But nothing in that path would have noticed if they were not. One of the three ways to install the tool does verify what it downloads, so the agent recommended using that one.

Just as useful was the list of things the agent said it could not confirm. It had not run the software, so it could not promise the software was harmless. Every record it checked against was kept by the publisher, so if the publisher's own systems had been taken over, the records would still have matched. That honesty is what makes the report something a person can act on. "Looks fine, here is what we checked, here is what we did not" is a decision. "Safe" is a feeling.

Why Agent Anything makes this possible

The reason we could do this casually, for a routine update on an ordinary day, comes down to three things the platform provides.

A place where the dangerous part can happen safely. Downloading something that might be hostile and pulling it apart should never happen on a machine you care about. The agent did it in a workspace that was thrown away afterward, with nothing in it worth stealing and no way back to our systems. If the update had been poisoned, there was nothing for it to take and nowhere for it to go.

An agent that does the tedious part every time. The checks themselves are not difficult. They are boring, there are a dozen of them, and the update button is right there. People skip them for that reason alone. An agent does not get bored and does not skip steps, so the check can run on every release of every tool we depend on, not just the one that happens to make the news.

A record that outlasts the moment. The agent's report says what it collected, what it compared, what matched, and what was out of scope. Someone else can read it later and decide whether they agree. When the same question comes up next quarter, or a customer asks how we decide what to install, the answer is already written down.