The model's contribution to Phantom Raven, as Lee describes it, is a string. Generative tools invent package names during vibe coding sessions; a human attacker registers those names in a public repository and attaches a payload [3]. The compromise lands when an unmonitored developer script or an agent automatically fetches the recommended dependency and installs it into the build pipeline [4]. So the failure sits at dependency resolution, not at inference [1]. Pinned lockfiles, an internal mirror, a publisher check before an unfamiliar name enters the graph: none of those are AI controls, and all of them would have been on the same list five years ago.
That placement is what should decide the purchase order. A session monitor wrapped around an AI assistant sees a suggestion. It does not gate the fetch, because the fetch happens in the build system, usually under a service account, often on a schedule. Bought to close an audit finding, it sits beside the attack path rather than across it [1]. Lee gives one condition that overrides his own per-dollar ranking, and it is not the presence of AI: where an environment holds ultra-sensitive intellectual property, high-value financial records or regulated data that cannot cross a boundary, he says segmentation has to come first regardless [9].
The self-hosting argument runs the same way. Bringing a model in house stops data going to a third-party SaaS provider, but Lee calls it a false comfort if you treat it as the security answer, because the operational responsibility simply moves onto your team [10]. Local hosting does nothing to bound what the agent can reach: it can still run malicious local commands, pull unverified external dependencies, or leak credentials when its execution environment has no boundaries [11]. Patching the model infrastructure becomes yours too [14]. The thing that constrains an agent is the network around it, which is the same control being weighed for the boring package problem.
Worth keeping the evidence in proportion. This is one interview with one named executive, published by Help Net Security [0], with no incident counts, no dates and no customer detail behind the word "majority" [1]. Lee is not claiming the exotic vectors are fiction. He calls manipulated weights, poisoned vector stores and compromised MCP servers real structural threats that currently live in research and demonstrations [2], and warns that a single campaign found in the wild turns a proof of concept into a headline overnight [12]. The useful reading is that the containment layer he describes as indifferent to which tool or exploit is involved [6] is the one purchase that covers both the incidents already happening and the ones still on the conference circuit [2]. Instrumentation only covers the surfaces you have already named.
