AI supply chain attacks expose the agentic action layer risk

At a glance

What this is: This analysis argues that the real weak point in enterprise AI is the middleware layer connecting LLMs to data, not the model itself.

Why it matters: It matters to IAM and security teams because compromise of AI proxies and MCP servers turns machine-to-machine traffic, secrets, and delegated access into the primary attack surface.

By the numbers:

• 60.2% of organizations admit a profound lack of control over the security of the AI models driving their applications.
• 48.9% are essentially blind to non-human, machine-to-machine traffic.

👉 Read Salt's analysis of the Mercor and LiteLLM AI supply chain attack

Context

AI supply chain security is becoming an identity and access problem as much as a software problem. When organisations route model traffic through proxies, gateways, and MCP servers, those components inherit the ability to handle sensitive data, invoke tools, and mediate trust between internal systems and external LLMs. That creates a new governance gap for AI agent identities and the secrets they use.

The Mercor and LiteLLM incident is a useful example because it shows how compromise at the middleware layer can bypass model-centric controls entirely. In practice, many teams still treat AI integrations as application plumbing, not as a governed control plane. That is atypical for mature identity programmes and increasingly dangerous for AI deployments.

Key questions

Q: What breaks when AI tools are exposed through loosely governed MCP servers?

A: Loose governance lets model-driven tools cross from context retrieval into state-changing actions without enough oversight. That can expose sensitive data, trigger unauthorized system changes, or widen lateral movement paths. The failure is a control boundary mismatch between what the AI can ask for and what it can safely do.

Q: Why do AI middleware compromises matter to IAM teams?

A: They matter because proxies, gateways, and MCP servers behave like machine identities with access to data and tools. If those identities are not inventoried, scoped, and monitored, IAM controls cannot see who or what is actually acting on behalf of the model. That creates hidden privilege paths inside the AI stack.

Q: What do security teams get wrong about AI in procurement?

A: They often focus on model capability and ignore governance boundaries. The real issue is whether the vendor can prove what data is used, who can access it, how it is retained, and whether the organisation has a clear opt-in decision before the capability becomes active.

Q: Who is accountable when AI search exposes sensitive enterprise data?

A: Accountability sits with the teams that approved the data connections, retrieval scope, and response handling, not just the users who queried the system. Governance should cover access design, provenance controls, and operational monitoring across identity, search, and AI platform owners.

Technical breakdown

Why the agentic action layer becomes the real trust boundary

The agentic action layer is the set of proxies, gateways, and MCP servers that sit between an LLM and the systems it can reach. These components do more than route traffic. They terminate credentials, pass prompts, broker context, and often hold the keys that let AI systems touch internal data and tools. If that layer is compromised, the attacker does not need to jailbreak the model. They can abuse the trusted integration path instead, which is why AI supply chain security must include identity, secrets, and runtime governance.

Practical implication: inventory every AI intermediary and treat each as a privileged machine identity.

How compromised AI middleware bypasses legacy web controls

Legacy WAFs and conventional API gateways are built to inspect human-originated traffic and common application patterns. They are poor at understanding machine-to-machine intent, especially when a legitimate AI proxy is the one making requests. A compromised middleware component can look indistinguishable from a normal workload while it exfiltrates prompts, keys, or response data. This is a classic control mismatch: the security stack sees valid protocol behaviour, but not malicious delegated use of trust.

Practical implication: add identity-aware telemetry and behavioural baselines for AI connectivity, not only perimeter filtering.

Shadow AI and MCP exposure in the AI supply chain

Shadow AI appears when teams deploy unapproved or poorly governed AI integrations outside central visibility. MCP servers increase that risk because they standardise tool and data access across a growing set of agentic workflows. Without discovery and lifecycle control, organisations accumulate exposed endpoints, unused integrations, and over-permissioned service accounts. The problem is not merely that more systems exist. It is that each one can become a hidden trust bridge into high-value data and actions.

Practical implication: discover AI proxies and MCP servers continuously, then enforce least privilege and offboarding controls.

Threat narrative

Attacker objective: The attacker wants to hijack a trusted AI integration path so they can steal data, abuse credentials, or manipulate model-connected workflows without attacking the model directly.

1. Entry occurs when attackers compromise a trusted AI proxy, gateway, or MCP server rather than the model itself. Credential access follows because these components often terminate API keys and other secrets used to reach downstream services.
2. Escalation happens through abuse of the proxy’s delegated trust, allowing machine-to-machine requests to blend in with legitimate traffic. Lateral movement can extend into connected data stores, model endpoints, and internal systems that trust the integration path.
3. Impact is data exfiltration, response manipulation, or unauthorized downstream action at machine speed, often without triggering controls designed for human traffic.

NHI Mgmt Group analysis

The agentic action layer is now a distinct governance domain, not an implementation detail. Proxies, gateways, and MCP servers sit in the trust path between models and enterprise data, so they function like privileged control planes. That means they must be governed as identity-bearing systems with lifecycle controls, not treated as disposable integration plumbing. For identity teams, the lesson is to extend machine identity oversight into AI mediation layers.

AI security programmes that stop at prompt filtering are missing the real control surface. The compromise described in this article shows that an attacker can bypass model safety mechanisms entirely by taking over the middleware that routes and mediates access. That shifts risk from content moderation to access governance, secrets handling, and runtime assurance. In practice, the decisive question is whether the organisation can see and constrain the machine identities that operate the AI stack.

Shadow AI creates governance debt that accumulates faster than most review cycles can absorb. Unapproved proxies and MCP servers introduce hidden trust bridges, over-permissioned tokens, and orphaned integrations that may persist long after the original use case is forgotten. The named concept here is agentic trust drift: the gradual expansion of trusted AI-mediated access beyond the controls originally approved. Practitioners should treat that drift as a lifecycle failure, not an innovation side effect.

Identity-aware detection becomes necessary when machine traffic can no longer be assumed benign. If a compromised proxy can look like a scheduled workload while exfiltrating data, then static signatures and coarse API monitoring are insufficient. Behavioural baselines, per-identity telemetry, and authorization context are what let teams distinguish legitimate orchestration from abuse. The practical conclusion is that AI observability must be coupled to identity governance.

OWASP NHI Top 10 and agentic AI guidance now intersect directly with AI supply chain risk. The same control themes that matter for non-human identities, secret sprawl, and over-privilege also apply to AI proxies and MCP servers. This is where identity governance, application security, and AI security converge. Practitioners should align AI control design with the OWASP Non-Human Identity Top 10 and the OWASP Agentic AI Top 10.

What this signals

Agentic trust drift: AI programmes are accumulating trust paths faster than most governance models can review them, which means the next control failure is more likely to be lifecycle-related than model-related. Teams should combine discovery, secret governance, and identity-aware telemetry so that AI middleware is managed as a privileged tier, not an integration afterthought.

The practical signal is that AI security now depends on the same disciplines that govern NHIs: ownership, scoping, rotation, and offboarding. Where those controls are weak, delegated access becomes the fastest route from a compromised proxy to enterprise data. Aligning AI operations with the OWASP Non-Human Identity Top 10 and the OWASP Agentic AI Top 10 helps teams define the control boundary.

For practitioners

• Map every AI intermediary Inventory proxies, gateways, MCP servers, and model-facing brokers, then classify each one as a privileged machine identity with named owners and lifecycle dates.
• Bind telemetry to machine identity Correlate AI traffic to the specific proxy or service account that generated it, so anomalous routing, unusual destinations, and bulk pulls can be attributed quickly.
• Restrict delegated AI access Apply least privilege to each model connector, remove unused tool permissions, and segment external LLM access from internal data paths that do not need it.
• Continuously discover shadow AI Scan repositories and runtime environments for unapproved AI integrations, then require offboarding when a proxy, token, or MCP server is no longer needed.

Key takeaways

• AI supply chain compromise shifts the primary risk from the model to the privileged middleware that brokers access and data flow.
• Machine-to-machine traffic can hide malicious activity inside otherwise valid AI workload behaviour, leaving legacy perimeter controls blind.
• Security teams should treat AI proxies and MCP servers as governed machine identities with discovery, least privilege, telemetry, and offboarding controls.

Key terms

• Agentic Action Layer: The agentic action layer is the middleware that lets an AI system reach tools, APIs, data stores, and external models. It is operationally important because it becomes the trust boundary where credentials, context, and execution rights are mediated and potentially abused.
• MCP Server: An MCP server is a tool endpoint that connects an AI agent to external systems and data sources through Model Context Protocol. Because it extends what the agent can reach, it becomes part of the identity and access surface and must be reviewed like any other privileged connector.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Identity-Aware Intent Analysis: Identity-aware intent analysis is a detection approach that ties behaviour to the specific machine identity performing it, then checks whether the observed actions fit the expected purpose. It helps distinguish legitimate orchestration from abuse in machine-to-machine environments.

What's in the full article

Salt's full article covers the operational detail this post intentionally leaves for the source:

• The specific Agentic Security Graph and how it maps LLMs, proxies, MCP servers, and APIs in runtime.
• The intent-analysis workflow Salt describes for correlating traffic to a machine identity and flagging anomalous sequences.
• The API Attack Surface Assessment process and the kinds of exposures it is designed to surface.
• The blocking actions and runtime triggers used when a proxy begins routing data outside its expected behaviour.

👉 Salt's full post covers the proxy compromise pattern, visibility gaps, and detection approach in more operational detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader access and lifecycle challenges that AI systems introduce.