AIVSS08 - Agent Supply Chain and Dependency Risk
Compromise via the agent's models, training data, libraries, plugins, or MCP/third-party service dependencies.
Intent & Description
'
🎯 Intent
Secure the supply chain of components used in agentic systems including models, data, libraries, and third-party services.
📋 Context
Agentic systems rely on third-party models, training data, libraries, plugins, and MCP services. A compromised component can backdoor the entire agent network, creating widespread security risks.
💡 Solution
Vet all third-party agent components. Use signed and verified plugins. Audit prompt templates. Implement component integrity checks. Maintain an agent component inventory. Monitor for supply chain compromises. Use SBOMs for AI components. Apply least privilege to dependencies.'
Real-world Use Case
Source
📌 TL;DR
Secure your agentic supply chain. Vet components, verify plugins, audit templates, track all agent dependencies.
Advantages
- Prevents component backdoors
- Enables component tracking
- Protects agent integrity
- Supports compliance requirements
Disadvantages
- Agent ecosystem is rapidly evolving
- Verification standards are immature
- Plugin auditing is resource-intensive