Source: Cloud Security Alliance
Author: unknown
URL: https://www.akto.io/blog/ai-supply-chain-security
ONE SENTENCE SUMMARY:
Agentic AI expands supply-chain risk from artifacts to instructions and execution, requiring continuous governance over components, inputs, permissions, and runtime actions.
MAIN POINTS:
- A benign npm MCP package later exfiltrated emails via a hidden update.
- Traditional controls help but miss instruction and agency risks unique to agents.
- AI supply chain includes datasets, weights, libraries, pipelines, and deployment infrastructure.
- Serialized model artifacts can execute code, so third-party weights resemble untrusted binaries.
- MCP servers shape risk through tool code, definitions, auth, and returned content.
- Skills combine natural-language guidance with scripts, influencing tool selection and execution.
- Plugins bundle multiple components, obscuring nested dependencies and external instruction sources.
- Agent configuration is security logic governing tools, memory, approvals, and execution behavior.
- Three trust decisions exist: artifact provenance, instruction influence, and execution authority.
- Runtime gaps enable tool poisoning, rug pulls, and malicious tool outputs to trigger data leaks.
TAKEAWAYS:
- Treat approval as time-bound; re-review whenever components, definitions, or references change.
- Maintain an AI bill of materials capturing versions, owners, permissions, and deployment contexts.
- Constrain blast radius with scoped identities, least-privilege credentials, and restricted environments.
- Evaluate full packages: instructions, scripts, metadata, dependencies, and remote content sources.
- Apply runtime policy enforcement plus tracing to stop violations and support rapid containment.