Threat T17
Supply Chain Compromise
Vulnerable, malicious or outdated components enter the agent through models, libraries, tools, plugins, prompt templates, build environments or framework updates. Because agents are long-lived and act autonomously, a single compromised component can spread across every agent that depends on it.
- 9/10 risk (Critical)
- 6 attack vectors
- 6 mitigating controls
- 5 framework refs
Overview
- Impact level: High
- Risk score: 9/10 (Critical)
- CIA impact: Confidentiality, Integrity, Availability
- Affected components: Language Models (KC1.1-KC1.4); Tool Integration Frameworks (KC5.1-KC5.3); Prompt templates, plugins, MCP servers and agent configuration
- Also known as: Supply Chain Attacks
- Tags: supply-chain, sbom, aibom, signing, plugins, dependencies
- Source: OWASP Agentic AI T&M v1.1 (2025-12)
Attack vectors
How attackers carry out supply chain compromise against an agentic system.
| Attack vector | Severity | Example |
|---|---|---|
| Compromised Framework or Extension Update | High | A destructive prompt shipped inside an AI coding-assistant extension release (Amazon Q Developer for VS Code 1.84.0) |
| Malicious or Typosquatted Tool Packages | High | Installing a look-alike MCP server, plugin or library that exfiltrates data or executes code |
| Poisoned Remote Prompt Templates | High | A prompt template or agent configuration fetched at runtime is altered to instruct the agent to leak data |
| Backdoored Models or Adapters | High | Fine-tuned weights or adapters from an unvetted source carry a hidden trigger |
| Poisoned Build Environment | Medium | A compromised CI pipeline produces tampered agent artifacts that still pass review |
| Outdated Vulnerable Dependencies | Medium | Unpatched agent-framework dependencies expose known RCE or deserialization flaws |
Affected components
KC1 Language Models (LLMs)
- KC1.1 Large Language Models (LLMs)
- KC1.2 Multimodal LLMs (MLLMs)
- KC1.3 Small-Language Models (SLMs)
- KC1.4 Fine-tuned Models
KC5 Tool Integration Frameworks
Mitigating controls
Controls from the catalog that reduce the likelihood or impact of T17.
M6 Comprehensive Security Monitoring & Auditing
Implement end-to-end observability with security-focused monitoring, anomaly detection, tamper-evident logging, and advanced threat hunting to ensure accountability, enable incident response, and detect rogue agents.
M13 Secure Development Lifecycle Integration
Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.
M17 Supply Chain Security & Provenance
Implement comprehensive supply chain security including model provenance verification, dependency management, secure development environments, and third-party component validation to prevent supply chain attacks and ensure component integrity.
M18 Incident Response & Recovery Framework
Implement comprehensive incident response capabilities specifically designed for agentic AI systems, including automated containment, forensic analysis, recovery procedures, and lessons learned integration to rapidly respond to security incidents and minimize impact.
M19 MCP Server Hardening & Tool Provenance
Treat every MCP server, A2A peer and tool definition as an untrusted, versioned dependency: admit only allow-listed and verified servers, authenticate and authorize every protocol request, validate and screen tool metadata and results before they reach the model, and require re-approval when a tool definition changes.
M20 Agent Supply-Chain Integrity
Extend software supply-chain controls to everything an agent loads at build or run time: models and adapters, prompt templates, agent cards, tool and MCP server definitions, plugins and framework updates.
Framework mappings
OWASP Top 10 for Agentic Applications
Cisco AI Security Taxonomy
OWASP AIVSS core risks
- AIVSS #4 Agent Supply Chain and Dependency Risk AIVSS 9.7 (Critical)
- AIVSS #1 Agent Orchestration and Multi-Agent Exploitation AIVSS 10.0 (Critical)
- AIVSS #2 Agentic AI Tool Misuse AIVSS 9.9 (Critical)
OWASP AISVS
Chapters cited by the mitigating controls: C1 Training Data Integrity & Traceability, C3 Model Lifecycle Management & Change Control, C4 Infrastructure, Configuration & Deployment Security, C6 Supply Chain Security for Models, C8 Memory, Embeddings & Vector Database Security, C9 Orchestration & Agentic Security, C10 Model Context Protocol (MCP) Security, C12 Monitoring, Logging & Anomaly Detection.
Requirements: C12.1.1, C12.1.2, C12.1.3, C12.1.4, C12.2.1, C12.2.2, C12.4.2, C12.4.3, C12.5.3, C9.4.2, C3.1.1, C3.3.1, C3.4.1, C3.4.2, C4.1.1, C6.1.4, C6.1.1, C6.1.2, C6.1.3, C6.2.1, C6.2.2, C6.2.3, C3.1.2, C3.1.3, C1.1.2, C9.6.1, C9.6.3, C9.1.3, C3.3.2, C8.3.2, C10.1.1, C10.1.2, C10.1.3, C10.2.1, C10.2.4, C10.2.5, C10.2.7, C10.3.1, C10.3.3, C10.4.1, C10.4.2, C10.4.7, C10.4.8, C9.3.7, C9.5.5, C9.2.5.
MITRE ATLAS
- AML.T0010 Supply Chain Compromise
- AML.T0012 Valid Accounts
- AML.T0018 Manipulate AI Model
- AML.T0018.003 Manipulate AI Model: Modify Prompt Construction Logic
- AML.T0049 Exploit Public-Facing Application
- AML.T0050 Command and Scripting Interpreter
- AML.T0051 LLM Prompt Injection
- AML.T0053 AI Agent Tool Invocation
- AML.T0067 LLM Trusted Output Components Manipulation
- AML.T0068 LLM Prompt Obfuscation
- AML.T0074 Masquerading
- AML.T0107 Exploitation for Defense Evasion
- AML.T0109 AI Supply Chain Rug Pull
- AML.T0110.002 AI Agent Tool Poisoning: Runtime Response
- AML.T0112 Machine Compromise
- AML.T0112.001 Machine Compromise: AI Artifacts
- AML.T0115.001 Publish Poisoned AI Artifacts: Models
References
Source: OWASP Agentic AI – Threats and Mitigations 1.1 (Dec 2025) · retrieved 2026-11