Remember when “supply-chain attack” went from security-conference jargon to something your non-technical coworkers were suddenly asking about? That was the moment a lot of us realized software doesn’t arrive from nowhere. It arrives through a long chain of vendors, updates, libraries, and build servers, and if you poison any link in that chain, you get everything downstream for free.
So here’s a story from that world with a twist I didn’t expect, and one that says something useful about where automation ends and people begin.
What actually happened
In 2026, an undercover Google analyst infiltrated TeamPCP, a notorious supply-chain hacking group. Not scanned them. Not modeled their behavior. Joined them. The researcher who went undercover, Austin Larsen, followed a trail of operational security lapses allegedly made by one of the group’s members, and that trail was the way in.
Being inside gave Google something you can’t buy off a threat-intelligence shelf: a view of the group’s internal workings while those workings were still happening. That let Google monitor and disrupt their activity, and it let the analyst pass along intelligence used to warn and protect potential victims before they became victims.
Late last month, Ruben Ian Thomson and Louis Michael Gaebler, both Australians in their early 20s, were arrested by Australian police in a joint investigation with assistance from the FBI, charged in connection with the group. Ars Technica reported the details.
Why an AI explainer cares about a spy story
I write about AI agents for people who don’t write code, and a big part of that job is managing expectations in both directions. Agents are genuinely good at some things people assume are hard, and genuinely bad at some things people assume are easy.
This case sits right on that line. Look at the two halves of the operation:
- Finding the mistakes. Someone slipped up on operational security, leaving small traces that connected a pseudonym to a real person. Sifting enormous piles of data for faint, repeated patterns is exactly the kind of work machines are built for.
- Becoming a trusted member of a criminal crew. Reading the room, building rapport, knowing when to stay quiet, deciding what to say next with real consequences attached. No current agent does this, and the gap isn’t small.
The first half is a search problem. The second is a judgment problem, sustained over time, with a human on the other side who is actively suspicious. If you have been told that AI agents are close to handling open-ended work in hostile conditions, this is a good reality check.
The part that should get your attention if you use AI tools
Supply-chain attacks work because software trusts its own ingredients. And AI agents are unusually hungry eaters. Ask an agent to build you something and it will happily pull in packages, call third-party services, and run tools it fetched a second ago. Every one of those is an ingredient you didn’t personally inspect.
That means the supply chain isn’t an abstract enterprise-security topic anymore. It’s the pantry your agent cooks from. A compromised package in a popular library reaches you whether you’re a Fortune 500 engineering team or one person vibe-coding a side project on a Saturday.
Practical takeaways for non-technical readers who are using agents anyway:
- Prefer well-known, actively maintained packages when your agent suggests dependencies, and ask it to pin exact versions rather than open ranges.
- Be suspicious of package names that look almost right. Typo-variants of popular libraries are a standard trick.
- Don’t hand an agent credentials it doesn’t need. Scope keys tightly and rotate them.
- Treat anything an agent pulled from the internet as untrusted input, including text that seems to be giving the agent instructions.
What the story tells us about defense
The pattern worth noticing is the division of labor. Machines narrowed the field. A person did the thing that required nerve and social read. Then law enforcement in two countries did the part neither could do, which is making it stop.
That’s a useful mental model for AI at work generally, not just in security. The most effective setups aren’t fully automated or fully manual. They’re layered, with automation handling volume and humans handling ambiguity, trust, and consequence. When you hear someone promise an agent that replaces a whole function end to end, ask which layer they mean.
The other thing I keep circling back to is how ordinary the opening was. Not an exotic exploit. Sloppiness, repeated often enough to form a pattern. Attackers have to keep their own operational hygiene perfect forever, and people are bad at forever. That cuts both ways, which is the real argument for putting boring, consistent habits around the flashy new tools we’re all handing our work to.
🕒 Published: