ASI Tracker: Add CVE-2026-28353 - Trivy VSCode Extension Agentic Supply Chain Compromise

Key Changes:

• Adds one new entry to the ASI Agentic Exploits & Incidents Tracker

Summary

Adds the March 2026 Trivy VSCode Extension supply chain compromise (CVE-2026-28353, CVSS 4.0 base score 10.0) to the Agentic Exploits & Incidents tracker.

Why this incident belongs in the tracker

This is a publicly documented, in-the-wild incident where an AI coding agent was weaponized as an autonomous exfiltration channel, not just a traditional supply chain compromise that happened to involve an AI-adjacent tool. The NVD description explicitly states the malicious code was "designed to leverage local AI coding agent to collect and exfiltrate sensitive information."

The incident was filed under CWE-506 (Embedded Malicious Code), a classification that captures the payload delivery but omits the agentic exploit primitive, specifically, that the AI coding assistant's legitimate capabilities (file access, code analysis, context gathering) were repurposed as the exfiltration mechanism. This mis-classification pattern is relevant to the ASI initiative's goal of distinguishing agentic threats from traditional LLM classifications.

ASI mapping rationale

• ASI01 (Agent Behaviour Hijack) : the coding agent's goals were hijacked to serve as an exfiltration channel
• ASI02 (Tool Misuse & Exploitation) : the agent's legitimate file-access and code-analysis tools were misused for data collection
• ASI04 (Agentic Supply Chain Vulnerabilities) : supply chain compromise via marketplace extension distribution
• ASI05 (Unexpected Code Execution (RCE)) : the payload achieved code execution on developer workstations

Scope

• One new row added at the top of the tracker table (most recent entry).
• No other changes.