Anyone in the know how about whether the CIA subverted the security of software or whether they inserted vulnerabilities into software? One of the shocking and

Anyone in the know how about whether the CIA subverted the security of software or whether they inserted vulnerabilities into software? One of the shocking and disgusting things from the NSA leaks was that it actively sought to create new vulnerabilities and to create subverted software industry products in the United States. So far it looks like the CIA is using discovered vulnerabilities (imo better than sabotaging industry). But given the size of the leaks I'm having difficulty confirming that this is indeed the case.