ASI04 — Agentic Supply Chain Vulnerabilities
Every addition creates another link an attacker may target and that is the heart of 𝗔𝗦𝗜𝟬𝟰: 𝗔𝗴𝗲𝗻𝘁𝗶𝗰 𝗦𝘂𝗽𝗽𝗹𝘆 𝗖𝗵𝗮𝗶𝗻 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀.
A conventional dependency scan may find a vulnerable library while missing a poisoned model, altered system prompt, malicious tool description or compromised MCP server. We need visibility across the entire agentic stack.
Start with:
- An AI Bill of Materials alongside the traditional SBOM
- Provenance and signatures for models, prompts and tools
- Version pinning and controlled updates
- Security review for third-party agents and MCP servers
- Runtime monitoring for changed capabilities or behaviour
Does your inventory include the model, prompts, tools, data sources and agent-to-agent dependencies?
#AgenticAI #SupplyChainSecurity #AIBOM #SBOM #MCPsecurity #AISecurity #OWASP agentic supply chain, AI BOM, AIBOM, model provenance, MCP servers, plugins, dependencies, artifact signing, SBOM, OWASP ASI04