By ByteBot
Your AI coding agent just ran pip install without asking. The package version it picked came from training data that predates the CVE. npm audit will find the problem — after the package is on disk, after the build ran, after the agent moved on. Refuse intercepts that install before it happens. That is the entire pitch, and it is the right one for 2026.
Post-Install Auditing Is a Pre-Agent Design
Audit tools were designed for a world where a human typed every install command. That world is gone. Claude Code, Cursor, and Codex CLI issue npm install and pip install autonomously from inside tool calls, using package versions their training data remembered — which can be months or years behind the current patched release. Endor Labs found that 49% of dependency versions imported by AI coding agents carried known vulnerabilities. Not “might have issues.” Known CVEs, catalogued, with patches already available.
npm audit will catch this — after the package is on your disk. pip-audit will catch it — after it is in your virtual environment. By then your agent has probably already moved on to the next task. A July 2026 TechTimes investigation confirmed attackers are actively exploiting this gap: supply chain campaigns targeting AI coding agents hit 2.6× the campaign volume of all of last year combined in just the first half of 2026.
What Refuse Does
Refuse is a pre-install shim. One binary wraps 18 package managers — npm, pnpm, yarn, bun, npx, pip, pip3, uv, poetry, pipenv, pdm, pipx, cargo, gem, bundle, go, composer, and dotnet. Every install command, regardless of who or what issued it, routes through Refuse before touching the registry. It checks the target package and version against 362,000+ advisories across 21 ecosystems. If there is a match, it blocks the install and tells you the safe version.
The user experience looks like this:
# Install all 18 shims
curl -sSL https://refuse.dev/install.sh | sh
refuse init # paste your API key, or skip for self-hosted localhost
# What a blocked install looks like
pip install requests==2.20.0
# refuse: blocked -- CVE-2018-18074 (CVSS 6.5), CVE-2023-32681 (CVSS 6.1)
# Safe version: requests==2.32.4That is the same experience whether the install came from your terminal, your AI agent’s tool call, or a CI step. Refuse does not care who pulled the trigger — it checks every one.
The Attack Context That Makes This Urgent
January 2026 gave us OpenClaw: an AI agent framework that went viral and within three weeks had 138 CVEs, 1,400+ malicious skills in its marketplace, and 42,665 exposed instances. March brought a LiteLLM backdoor that sat on PyPI for three hours and racked up 47,000 downloads — hitting every AI agent framework that uses LiteLLM as its LLM gateway, which is most of them. In both cases, the developers installing those packages had no pre-install check in place.
The broader pattern — AI agents processing poisoned repos or injected prompts and autonomously running malicious install commands — is no longer theoretical. The community has started saying it plainly: stop auditing dependencies after they install. Block them before.
Where Refuse Fits Among Existing Tools
This is not a replacement for Snyk, Dependabot, or Socket. Those tools monitor your dependency tree over time, catch new CVEs on packages you already have, and open PRs. That work still matters. Refuse handles a different moment: the instant an install command runs.
AgentGuard covers a wider governance surface — prompt injection defense, secret protection, action enforcement — but it is not a package manager shim. It does not sit in front of pip install. npm audit is single-ecosystem and post-install. Refuse is the only tool in this space that wraps every major package manager, blocks pre-install, and was built explicitly for environments where AI agents issue install commands.
Deploying It
Two paths: the managed tier (API key from refuse.dev) or self-hosted (one Docker container, point Refuse at localhost). For CI pipelines, prepend the shim directory to PATH and every subsequent install in the pipeline runs through Refuse automatically:
# CI: add to PATH before any install steps
export PATH="$HOME/.refuse/bin:$PATH"
# Self-hosted
docker run -p 8080:8080 refusedev/server
refuse config set server_url http://localhost:8080No changes to your package files. No changes to your agent configuration. The shims wrap the real package managers transparently.
The Verdict
Pre-install blocking is the right abstraction for AI-assisted development. Refuse does one thing, covers all the package managers that matter, and requires zero changes to your existing code or agent setup. If you are using Claude Code, Cursor, or any AI coding agent that issues install commands autonomously, Refuse belongs in your environment. The advisory database is live; it will block on a LiteLLM-style backdoor the moment an advisory is published — faster than your next audit scan, and certainly faster than your AI agent’s training cutoff.
