TL;DR: AgentMesh is joining VirusTotal's Crowdsourced AI program to add behavioural analysis for MCP servers, AI skills and VS Code extensions, surfacing prompt injection, typosquatting, unexpected network behaviour and secret exfiltration patterns in the agentic software supply chain, according to Knostic. The signal is clear: agent tooling now needs supply-chain-style inspection because traditional signature-based controls are too slow for fast-moving AI components.
At a glance
What this is: Knostic argues that agentic AI supply chain threats are now affecting the security tools used to inspect AI components, with behavioural scanning aimed at MCP servers, AI skills and VS Code extensions.
Why it matters: This matters because AI agent ecosystems are becoming part of the enterprise control plane, and IAM, security engineering and AI governance teams need ways to inspect the software and credentials these components consume.
Context
Agentic AI supply chain risk sits at the point where plugins, extensions and model-connected tools become operational dependencies. Once those components can issue prompts, call services, or carry credentials, they stop behaving like inert software artefacts and start acting like governed access paths that can carry risk into production.
The security gap is that traditional controls were built to inspect files, packages or endpoints after distribution, not to understand the behaviour of agent-facing components in real time. That creates a governance blind spot for organisations that are adopting MCP servers, IDE extensions and AI skills faster than they can inventory and classify them.
For identity teams, the important intersection is that these components frequently rely on secrets, delegated access and non-human identities. The subject is broader than IAM, but the failure mode is familiar: unmanaged trust edges, weak provenance and credentials exposed to third-party software.
Key questions
Q: What breaks when an MCP server or extension is trusted without behavioural inspection?
A: The trust model breaks because the component can look legitimate at install time while still carrying prompt injection, typosquatting or secret-exfiltration behaviour at runtime. That turns a simple software dependency into an active control path inside the agent workflow. Security teams need to evaluate what the tool can do, not just who published it.
Q: Why do agentic AI tools create more supply chain risk than standard plugins?
A: They create more risk because they can influence decisions, call services and interact with secrets inside a live workflow. A compromised agent tool is not just a bad package, it is a trusted path into delegated action. That makes behavioural trust and access scope the key governance variables.
Q: What are the signs that AI agent access is becoming unsafe in enterprise environments?
A: Common warning signs include broad standing permissions, unclear ownership of agent credentials, excessive access to multiple data domains, and weak logging around agent actions. Risk also rises when teams cannot explain which systems an agent touched, why access was granted, or how quickly it can be revoked. Those gaps usually indicate governance has not kept pace.
Q: How should teams govern non-human identities in AI-heavy environments?
A: Teams should govern non-human identities the same way they govern other privileged assets: assign ownership, minimise scope, rotate credentials regularly, and monitor for abnormal use. The key difference is speed. AI-driven workflows can exploit exposed access quickly, so detection and revocation must be automated and tied to lifecycle controls.
Technical breakdown
Why agentic supply chain risk is different from normal software risk
Agentic supply chain risk is not just about whether a package is signed or a binary is known to be malicious. The issue is that AI-facing components can embed instructions, prompt payloads, network calls and credential access into the same runtime path that agents use for work. That means the security question shifts from simple integrity checking to behavioural trust. MCP servers, AI skills and IDE extensions can all influence model outputs and downstream actions, so the blast radius is operational rather than purely code-based.
Practical implication: inspect agent-facing components for behaviour, not just provenance.
How prompt injection and typosquatting reach the agent runtime
Prompt injection in this context means hostile instructions hidden in tool descriptions, responses or metadata that the agent then consumes as part of execution. Typosquatting exploits naming trust by impersonating legitimate components so that developers install or connect the wrong tool. Once the agent trusts the component, the malicious payload can steer actions, request secrets or trigger unexpected network behaviour. The risk is magnified when the component sits inside developer workflows, because the environment already contains high-value credentials and privileged access paths.
Practical implication: govern tool ingestion and trust decisions before agents consume the component.
Why security workflows need continuous AI component inspection
Security workflows increasingly need to treat AI components like a live supply chain rather than a one-time procurement event. Behaviour can change after publication, dependencies can shift, and a seemingly benign extension can later become a channel for secret exfiltration or command redirection. That is why continuous scanning, verdicting and searchable intelligence matter. The practical model is similar to threat intelligence for code and packages, but adapted to agentic behaviour, delegated access and tool chaining.
Practical implication: add continuous inspection for MCP servers, skills and extensions to security operations.
Threat narrative
Attacker objective: The attacker wants to use trusted agent tooling as a delivery path for secret theft, workflow manipulation, or broader supply chain compromise.
- Entry occurs when developers or operators connect an MCP server, AI skill or IDE extension into an agentic workflow as a trusted tool.
- Credential access or manipulation follows when the component embeds prompt injection, requests secrets, or triggers behaviour that exposes tokens and other non-human identities.
- Impact is achieved when the agent executes attacker-influenced actions, exfiltrates secrets, or propagates unsafe behaviour into production workflows.
Breaches seen in the wild
- Secrets in VS Code extensions 2025: Wiz found 550+ secrets in VS Code extensions, including publishing tokens able to push malicious updates to about 150,000 installs.
- Amazon Q Developer extension compromise 2025: An over-scoped CI token let an attacker ship a prompt telling Amazon Q's AI coding agent to wipe files and AWS resources (CVE-2025-8217).
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agentic supply chain security is now an access-control problem, not only a code-trust problem. Once MCP servers, skills and extensions can influence prompts, trigger network calls or touch credentials, they become part of the identity perimeter. That makes provenance useful but insufficient, because the real issue is whether the component can exercise delegated authority inside a live workflow. Practitioners should treat AI tool ingestion as a governed trust decision, not a software-installation event.
Behavioural inspection is the missing control plane for fast-moving AI components. Static review cannot keep pace with tool descriptions, prompt payloads and post-publication changes that alter how a component behaves. The article's core signal is that security teams need verdicting that evaluates what a component does when connected to an agent, not only what it claims to be. That shifts control design toward runtime observation, policy enforcement and continuous reclassification.
Agentic trust is a supply chain concept with NHI consequences. These tools often operate with secrets, tokens and delegated access, which means compromise does not stop at the plugin boundary. It flows into the credentials and service identities the agent can reach. The governance gap is not just tool sprawl but untracked non-human access paths created by tool sprawl, so IAM and AI security teams need a shared inventory and ownership model.
Security platforms are starting to absorb agentic intelligence because the category is maturing faster than manual review can handle. That does not mean every AI component should be blocked by default. It does mean organisations need a repeatable way to classify agent-facing artefacts, compare them against behavioural risk signals, and determine whether they are safe enough for enterprise workflows. The practitioner conclusion is simple: inspect the agentic software supply chain before it becomes part of production control paths.
Agentic software supply chain drift is the governance problem this article surfaces. As AI tools proliferate, the gap widens between what teams think they deployed and what the agent actually trusts at runtime. The result is a control failure that spans provenance, runtime behaviour and delegated identity. Practitioners should respond by treating agent tooling as a governed asset class with explicit ownership and review.
From our research library:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- Read next: Agentic AI Identity Guide
What this signals
Agentic software supply chain drift: the faster organisations add MCP servers, AI skills and coding extensions, the harder it becomes to know which components are still trustworthy at runtime. The control problem moves from installation to continuous revalidation, because the asset is no longer the package alone but the behaviour it can exercise inside the agent workflow.
For identity and security teams, the important shift is that AI tooling now carries non-human identity risk through delegated access. Secret exposure, standing privilege and untracked third-party access are no longer edge cases in this space, they are the likely failure modes when agent tooling is allowed to operate without a governed trust boundary.
For practitioners
- Inventory every agent-facing component Catalogue MCP servers, AI skills, coding-agent tools and VS Code extensions that can influence production workflows or touch credentials. Record owners, trust level, data access and whether the component can call external services.
- Inspect for prompt injection and malicious behaviour Scan tool descriptions, responses and metadata for embedded instructions, typosquatting signals, unusual network activity and secret-exfiltration patterns before allowing enterprise use.
- Treat delegated access as a governed NHI path Review which non-human identities, tokens and API keys an agent can reach through each tool, and remove standing access that is not required for the task.
- Revalidate tools after dependency or metadata changes Create a re-review trigger whenever an extension, skill or MCP server changes publisher, package metadata, dependency chain or observed network behaviour.
Key takeaways
- Agentic AI supply chain threats are no longer theoretical because toolchains that power agents can also deliver prompt injection, typosquatting and secret exfiltration.
- The article's strongest signal is the need to inspect behaviour at runtime, not just provenance at install time, because static review misses how agent tools actually act.
- Identity teams should treat agent-facing tools as governed access paths and require inventory, ownership and revalidation before those tools touch credentials.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI04 — Agentic Supply Chain Vulnerabilities | The article is about malicious and risky AI tool supply chains. |
| ASI02 — Tool Misuse | The article focuses on agent tools that can be abused to redirect or manipulate actions. | |
| Recommendation — Apply ASI04 to inspect agent-facing tools for provenance, behavioural drift and malicious dependency paths. Use ASI02 to constrain which tools agents can invoke and what those tools are allowed to do. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Secret exfiltration from agent tools is a central threat pattern in the article. |
| NHI-03 — Vulnerable Third-Party NHI | Third-party extensions and skills are the supply chain entry point described here. | |
| Recommendation — Scan agent tools for secret leakage and revoke any component that can expose tokens or API keys. Require third-party NHI review before allowing extensions, skills or MCP servers into production workflows. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article is about governance of agentic AI components in enterprise workflows. |
| Recommendation — Define ownership, approval and review responsibilities for all agent-facing AI components under GOVERN. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Agent tools often reach secrets and privileged access paths. |
| Recommendation — Enforce PR.AA-05 so agent tooling only reaches the entitlements required for its task. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The article describes credential theft and secret exfiltration paths through AI tooling. |
| Recommendation — Map agent-tool abuse to TA0006 and TA0010 to prioritise detections for credential theft and exfiltration. | ||
Key terms
- Agentic Supply Chain: The collection of models, tools, plugins, prompts, memory stores, and middleware that an AI agent depends on to operate. Weaknesses in this chain can introduce hidden instructions, poisoned context, or exposed secrets, so security teams need inventory, trust validation, and isolation controls across the entire path.
- Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Behavioural Analysis: Behavioural analysis is the practice of judging an identity by how it acts, not only by the credentials it presents. For AI agents, this means monitoring task paths, tool use, and interaction patterns so deviations from approved behaviour can be detected and investigated.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management for practitioners responsible for agentic and identity-adjacent risk. It is designed for teams that need to connect access control with real-world identity governance decisions.
Published by the NHIMG editorial team on July 9, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org