Understand the agentic supply chain: 5 things CIOs must know

Software supply chain risk used to have a fairly contained definition: open-source packages, build pipelines, and the occasional compromised maintainer account. AI agents have changed that. An agent assembles capability at runtime, pulling in models, MCP servers, libraries, code, tools, skills, and plugins, then acts on its findings. Agents operate at machine speed in parallelized workflows at speed and volume far greater than those of human-paced developers.

This differs from the dependencies CIOs have long governed. An agent’s tool catalog can change the day after approval, and the agent will trust whatever shows up the next time it looks. OWASP now includes Agentic Supply Chain Vulnerabilities (ASI04) in its Top 10 for Agentic Applications, describing risks that “arise when agents, tools, and related artifacts they work with are provided by third parties and may be malicious, compromised, or tampered with in transit.”

Here are five things technology leaders must understand about the agentic supply chain as agents become part of enterprise operations.

1. An agent can inherit the trust of something it connects to

When an agent calls a tool or connects to an MCP server, it absorbs that component’s context and ability to action into its own reasoning. Integrating an MCP server establishes a trust relationship that affects every connected agent.

That trust can travel through plaintext instructions and metadata in addition to code. An attacker doesn’t need to compromise a tool’s implementation to compromise the agent using it. A tool’s description (the metadata an agent reads to decide how and when to call it) is enough to influence how an agent reasons about and invokes that tool. Hiding an instruction inside a text description can be enough for an agent to follow it.

It isn’t enough to review the tool description before approving. You must review what the tool, and everything the tool talks to, is doing on every call after that.

2. Traditional supply chain security can’t see this layer

Dependency scanning, SBOMs, and code review were built to catch risk in artifacts that don’t change once they ship. MCP servers, tools, and skills don’t work that way; they’re discovered and called at runtime. CrowdStrike research on agentic tool chain attacks makes the gap explicit: Dependency scanning has no visibility into tools that evolve outside the deployment pipeline.

OWASP describes the same shift: Agentic ecosystems “often compose capabilities at runtime … thereby increasing the attack surface.” Agents pulling models, skills, and plugins from the internet expand the risk profile of shadow AI.

Individual tools and descriptions can change independently of the application deployment process, allowing agent behavior to change without a traditional software release gate. Security researchers call this a rug pull: a tool that passes review, then changes after deployment. OWASP recommends pinning tools and configurations by content hash and rolling back automatically when the hash drifts.

3. Attackers are exploiting the agentic supply chain

In September 2025, Koi Security reported what it called the first malicious MCP server found in the wild. An attacker copied a legitimate open source project and quietly added a line to their new version that bcc’d every email the tool sent to an attacker-controlled address. The package drew around 1,500 downloads before its developer deleted it from npm, but this action didn’t remove it from systems that already had it installed.

In August 2026, a worm targeting the keyv/cacheable npm ecosystem went after developers, eventually poisoning 1,684 versions across 420 package names. In July 2026, a researcher-filed GitHub security advisory disclosed an MCP tool in nginx-ui that created a direct path to remote code execution.

All three exploit the same gap: components that agents and AI coding tools load and run automatically. The common thread is reach. Each incident turned something an agent or developer tool could touch (outbound email, repo configuration, a live web server) into an attacker’s foothold.

4. Agent marketplaces and registries multiply the exposure

As agents pull skills and plugins from third-party marketplaces, the exposure scales with the catalog. Antiy’s research into the OpenClaw skill marketplace identified 1,184 malicious skills that had appeared there over time, with a single author account responsible for 677 of them.

Marketplace presence, popularity, and ranking shouldn’t be treated as evidence that an agent component is trustworthy. Once agents pull capability from open registries at scale, “who approved this skill” stops having one answer.

5. Securing the agentic supply chain means tracing the whole chain

A poisoned tool doesn’t stay a tool problem. Scanning the tool at the moment it’s approved says nothing about what it does six months later.

CISA and Australia’s ASD, in joint guidance on adopting agentic AI, break the resulting risk into five categories you can use as a starting checklist: privilege risks, design and configuration risks, behavior risks, structural risks, and accountability risks. Each maps to a question the agentic supply chain raises: What can this component do, how was it configured, how does it behave, how is it wired into everything else, and who’s accountable when it goes wrong?

CrowdStrike frames the work in a similar sequence: Discover the AI agents running, secure the agent supply chain feeding them, establish continuous identity for what they do, then detect and respond to what happens at runtime. Securing the supply chain is one stage in that sequence.

With agents, the dependency chain remains live at runtime. The software supply chain doesn’t end anywhere: Every tool, skill, and MCP server an agent uses can change for as long as the agent keeps running.

CrowdStrike Falcon® Guardian brings AI detection and response (AIDR) to the endpoint, where AI agents execute, providing visibility into the agents operating across endpoints, the resources and systems they interact with, and what they do at runtime. When a supply chain component introduces risk, Falcon Guardian helps teams see what the agent did, investigate what happened, and respond before the threat spreads.

Learn more: Explore CrowdStrike AI Agent Security resources to see how organizations can secure the agentic supply chain and the broader AI estate.