AI coding agents route around the repository gate, and JFrog moves the checkpoint to the agent

Start with the arithmetic in JFrog's own report. If 2025 closed with more than 171,000 unique malicious npm packages after a 451% rise ^[4], the year opened from a base of roughly 31,000 ^[1]. That is the volume the curated repository was built to filter, and the filter only works on traffic that arrives at it.

The three described layers are not equally durable. Session steering hands the agent an Artifactory URL for each governed package type at the start of a session ^[6], which means the agent has to choose to use it. The `jf setup` binding is stronger: it configures the local package manager per project, survives sessions and tools, and catches the installs nobody typed, including postinstall scripts and `pip install -r requirements.txt` ^[6][7]. Only the third layer, server-side Curation, sits somewhere the requester cannot negotiate with ^[6]. JFrog writes that each layer enforces independently and that governance does not rely on agent compliance ^[10]; by the post's own description, two of the three execute in the client environment ^[2].

The server-side wall governs what passes through Artifactory ^[6]. It says nothing about a request that never goes there. The post does not describe blocking direct access to public registries or controlling agent egress ^[11], and public registries remain the default destination for agent-resolved dependencies across npm, PyPI, Maven, Go, Docker Hub, Helm and NuGet ^[2]. So the control that matters is routing and credentials, not the manifest. Nobody wrote a manifest: the agent picked the packages from a natural-language prompt ^[3].

Coverage is an allowlist. The feature ships for Claude Code and Cursor, with more agents promised ^[1]. Every agent, wrapper and CI runner outside that list keeps the behaviour JFrog describes as default rather than exceptional, with scanning and audit trails never applied ^[8]. And the fix is described entirely in JFrog parts, Artifactory, Curation and Xray ^[1][7], which is worth remembering when reading a vendor's account of the gap.