Owasp Agentic

title: 'ASI04: Agentic Supply Chain Vulnerabilities' description: OWASP Agentic Top 10 reference for supply chain vulnerabilities in agent frameworks, plugins, and tool dependencies

04 Agentic Supply Chain Vulnerabilities

Identifier: ASI04:2026 Category: Supply Chain

Description

Agentic supply chain vulnerabilities arise when agents, tools, and related artefacts they work with are provided by third parties and may be malicious, compromised, or tampered with in transit. These can be both static and dynamically sourced components, including models and model weights, tools, plugins, datasets, other agents, agentic interfaces (MCP, A2A), agentic registries and related artifacts, or update channels. These dependencies may introduce unsafe code, hidden instructions, or deceptive behaviors into the agent's execution chain.

Unlike traditional AI or software supply chains, agentic ecosystems often compose capabilities at runtime, loading external tools and agent personas dynamically, thereby increasing the attack surface. This distributed run-time coordination combined with agentic autonomy creates a live supply chain that can cascade vulnerabilities across agents.

Risk

• Introduction of unsafe code, hidden instructions, or deceptive behaviors through compromised third-party components.

• Cascading vulnerabilities across agents through runtime composition of dynamically sourced tools, models, and plugins.

• Exfiltration of private repository data or sensitive information through poisoned tool descriptors.

• Interception and manipulation of communications through malicious server impersonation.

• Routing of sensitive requests through attacker-controlled agents via forged agent cards or exaggerated capabilities.

• Widespread exposure of tampered components through compromised registry servers or agent management platforms.

Vulnerability checklist

• Agents automatically pull prompt templates from external sources that may contain hidden instructions leading to malicious behavior.

• Tool metadata or agent cards accept hidden instructions or malicious payloads that the host agent interprets as trusted guidance.

• Agents dynamically discover or connect to external tools or services that may be typosquatted or impersonated endpoints.

• Third-party agents with unpatched vulnerabilities or insecure defaults are invited into multi-agent workflows.

• Agent management or registry servers serve signed-looking manifests, plugins, or agent descriptors without proper verification.

• RAG plugins fetch context from third-party indexers that may be seeded with crafted entries to bias agent behavior.

Prevention controls

1. Sign and attest manifests, prompts, and tool definitions. Require and operationalize SBOMs and AIBOMs with periodic attestations. Maintain inventory of AI components.

2. Allowlist and pin dependencies. Scan for typosquats. Verify provenance before install or activation. Auto-reject unsigned or unverified packages.

3. Run sensitive agents in sandboxed containers with strict network or syscall limits and require reproducible builds.

4. Put prompts, orchestration scripts, and memory schemas under version control with peer review. Scan for anomalies.

5. Enforce mutual auth and attestation via PKI and mTLS. Sign and verify all inter-agent messages.

6. Pin prompts, tools, and configs by content hash and commit ID. Require staged rollout with differential tests and auto-rollback on hash drift.

7. Implement emergency revocation mechanisms that can instantly disable specific tools, prompts, or agent connections across all deployments when a compromise is detected.

8. Design systems with zero-trust security model that assumes failure or exploitation of agentic function components.

Example attack scenarios

Scenario A — Code assistant supply chain compromise

A poisoned prompt in a coding assistant repository ships to thousands before detection. Despite failing, it shows how upstream agent-logic tampering cascades via extensions.

Scenario B — Tool descriptor poisoning

A prompt injection in a public tool hides commands in its metadata. When invoked, the assistant exfiltrates private repo data without user knowledge.

Scenario C — Malicious server impersonation

A malicious MCP server on npm impersonates a legitimate email service and secretly BCCs emails to the attacker.

Scenario D — Agent-in-the-middle via agent cards

A compromised peer advertises exaggerated capabilities in its agent card. Host agents pick it for tasks, causing sensitive requests and data to be routed through the attacker-controlled agent which then exfiltrates or corrupts responses.

Detection guidance

• Re-check signatures, hashes, and SBOMs at runtime to detect tampered or modified components.

• Monitor behavior, privilege use, lineage, and inter-module telemetry for anomalies.

• Scan for typosquats across package registries including PyPI, npm, and AI tool registries.

• Verify provenance of all tools, agents, and plugins before activation and on an ongoing basis.

• Monitor agent card registrations for exaggerated capabilities or unverified descriptors.

Remediation

• Implement emergency revocation to instantly disable compromised tools, prompts, or agent connections across all deployments.

• Remove or quarantine any unsigned, unverified, or tampered components from the agent ecosystem.

• Re-sign and re-attest all manifests, prompts, and tool definitions after remediation.

• Roll back to pinned versions by content hash and commit ID when drift is detected.

• Require staged rollout with differential tests and auto-rollback for any supply chain changes.

• Enforce reproducible builds for all sandboxed agent containers.

Content derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Modifications: Restructured into agent-consumable reference format with added detection and remediation guidance.