Socket raises $60 million as AI agents increase supply chain risks

Socket, a security company focused on software supply chain protection, has raised $60 million. The company, founded by Firas Bugadija and led by CTO Amanas Rhee, provides tools to scan and block malicious packages across multiple ecosystems. Rhee reported that the frequency of supply chain attacks has surged from approximately 4,000 compromised package versions per week a year ago to nearly 12,000 per week currently. A novel threat vector involves self-propagating worms, first observed in the 'Shai Hulud' incident, which replicate across registries by exploiting access tokens found on developer machines. Attackers are increasingly targeting endpoints rather than production environments, using malicious packages to prompt local AI agents to act as unauthorized pen testers. Rhee noted that AI models frequently hallucinate package names, leading agents to install unvetted or malicious dependencies. The time-to-exploit for vulnerabilities has dropped from 2.3 years in 2018 to approximately eight hours in 2026. Socket has partnered with Replit to provide 'secure by default' scanning, blocking malicious packages before installation in agent-driven workflows. The company's team maintains projects that account for approximately 10 billion downloads per week from the NPM registry alone. Rhee argued that traditional security perimeters are insufficient against AI-driven, endpoint-focused attacks and that the industry must shift to 'secure by default' architectures.