15% Section 122 Tariff Hits Security Hardware Budgets

What Happened

The Supreme Court struck down Trump's IEEPA-based tariff regime 6-3, ruling that the word 'tariff' does not appear anywhere in the IEEPA statute. The court applied the Major Questions Doctrine — the principle that agencies cannot claim sweeping new powers from ambiguous statutory language. Within hours, the executive imposed a replacement tariff: first 10%, then escalated to 15% by the next morning under Section 122 of the Trade Act of 1974.

Why the Replacement Tariff Matters More Than the Ruling

Four separate intelligence sources covered this story from different angles, and the synthesis is clear: the headline victory is misleading. Average tariff rates only dropped from 16.9% to 15.4%. Treasury Secretary Bessent projects 'virtually unchanged tariff revenue in 2026.' The practical impact on your procurement budget is near-zero relief.

Section 122 is legally capped at 15% for no more than 150 days and requires a 'large and serious' balance-of-payments crisis as justification. The legal basis is widely considered weak. But here's the critical pattern: the previous tariff regime persisted for approximately 16 months before SCOTUS invalidated it. Even legally vulnerable tariffs survive for months during litigation.

Plan for 6-16 months of 15% surcharges on imported security hardware. The legal system moves slower than your procurement cycle.

What's Actually at Risk in Your Stack

Security appliances with international supply chains are directly exposed:

• Firewalls and network appliances — Palo Alto, Fortinet, and others source components globally
• Endpoint hardware — sensors, HSMs, and specialized security devices
• DR site buildouts — servers, storage, and networking gear for redundant infrastructure
• Cloud and SaaS vendors — contracts with tariff pass-through clauses could trigger automatic price increases

The macroeconomic backdrop compounds the pressure: core PCE inflation at ~3% and GDP growth at only 1.4% signal a stagflationary environment. Your security budget is being eroded from multiple directions simultaneously.

Third-Party Vendor Financial Risk

Smaller security vendors with thin margins and international supply chains may face financial stress from tariff costs they can't pass through. This creates a third-party financial risk that your vendor risk management program should be monitoring — a vendor going under mid-contract is a security event.

The New Supply Chain Risk Pattern

WorkOS launched npx workos — a CLI tool powered by Anthropic's Claude that reads a developer's project, detects the framework, and writes a complete authentication integration directly into the codebase. The agent typechecks, builds, and auto-fixes its own errors in a feedback loop until the code compiles.

This is not a code suggestion tool. This is an autonomous agent writing security-critical code and self-healing until it passes build checks. The distinction matters enormously:

• Authentication code is the highest-consequence code in any application — it controls identity, sessions, and access
• An AI agent that self-heals build errors may produce code that compiles and passes tests but contains subtle logic flaws: improper token validation, missing CSRF protections, overly permissive OAuth scopes
• Developer trust in 'it builds, so it works' bypasses the adversarial thinking that auth code demands
• The 'supplier' of this code is a non-deterministic language model — this is supply chain risk where the supply chain is invisible

When your developers let an AI agent write authentication code, they've introduced a supply chain dependency that doesn't show up in any SBOM.

Why This Is Urgent Now

WorkOS is not an outlier — it's the leading edge of a pattern. Every major AI coding tool (GitHub Copilot, Cursor, Amazon CodeWhisperer) is moving toward agentic workflows that write, test, and commit code with decreasing human oversight. Authentication and authorization paths are where this trend becomes a security event.

Most AppSec programs have policies for third-party libraries, open-source dependencies, and even AI-assisted code suggestions. Almost none have policies for AI-agent-authored code in security-critical paths — code that is generated fresh each time, never appears in a dependency manifest, and varies non-deterministically between runs.