AI supply chain security now spans models, prompts and plugins

At a glance

What this is: Straikerai argues that AI supply chain security now covers models, prompts, RAG pipelines and plugins, with risk spreading across every AI dependency layer.

Why it matters: For IAM and security teams, the key issue is that AI supply chains inherit credential, access and provenance weaknesses while adding new trust paths that need explicit governance.

Context

AI supply chain security is the set of controls that govern trust across model artifacts, training data, prompts, retrieval sources and tool integrations. In this article, Straikerai shows that the classic software supply chain problem has expanded into AI systems, where access paths, provenance and execution boundaries all matter.

The governance gap is that organisations often secure the model while leaving the surrounding ecosystem under-controlled. Once prompts, RAG corpora and plugin calls can influence output or execution, identity and access decisions become part of the security perimeter, not an afterthought.

Key questions

Q: What breaks when AI agents are allowed to act on untrusted prompts without runtime guardrails?

A: Without runtime guardrails, agents can be socially engineered into disclosing data, crossing policy boundaries, or executing unintended actions that look like normal work. The main failure is not a loud system error but a quiet trust failure. Teams may only discover the abuse after credentials, access, or sensitive data have already been exposed.

Q: Why do agentic AI tools create more supply chain risk than standard plugins?

A: They create more risk because they can influence decisions, call services and interact with secrets inside a live workflow. A compromised agent tool is not just a bad package, it is a trusted path into delegated action. That makes behavioural trust and access scope the key governance variables.

Q: What are the signs that RAG or plugin governance is failing?

A: The main signs are stale or suspicious content ranking highly, tool calls that exceed the workflow’s intended scope, and retrievals that ignore user authorization. If a document in the corpus can be surfaced without policy checks, or a function call is executed without context validation, governance is failing at runtime rather than at ingestion.

Q: How should organisations govern model provenance and tool access together?

A: Treat them as one control problem, not two. Model files, prompt templates, retrieval corpora and plugins all need ownership, authorization and traceability. If the system cannot prove who published an artifact, who can change it, and under what policy it can be used, then the AI supply chain is not governed end to end.

Technical breakdown

Model storage and deserialization risks

AI model files are not always inert data. Formats such as PyTorch and ONNX can carry serialized objects, which means a poisoned model may execute code when loaded if the runtime trusts the artifact blindly. That makes model registries, signing, provenance checks and restricted deserialization contexts part of the security boundary rather than optional hygiene. The operational lesson is that model distribution behaves like software delivery, not simple file transfer, so artifact integrity has to be verified before deployment.

Practical implication: treat model loading as code execution risk and require artifact signing plus provenance verification before deployment.

Prompt injection and transitive trust in agentic workflows

Prompt injection works because the model processes all tokens in one context window, not because it misunderstands user intent in a human sense. In agentic systems, the risk grows when an email, document or chat message can trigger tool use, data exfiltration or action execution through a delegated workflow. This is a transitive trust problem: the agent trusts content that should have been treated as untrusted input. Input filtering, output gating and constrained permissions reduce the blast radius, but only if the workflow boundary is explicit.

Practical implication: isolate untrusted text from tool-triggering logic and limit each agent to the smallest effective permission set.

RAG and plugin ecosystems need provenance and authorization

Retrieval-augmented generation and function-calling turn knowledge sources and tools into part of the runtime attack surface. If an attacker can write to the corpus, manipulate ranking or influence a plugin call, the system may surface malicious or stale content with legitimate-looking authority. That is why provenance metadata, access control at retrieval time, ABAC and continuous validation matter: presence in a vector database or tool catalog does not equal authorization. In practice, the trust decision has to happen on every retrieval and every call.

Practical implication: enforce retrieval-time authorization and provenance checks so approved content is not assumed to be safe by default.

Threat narrative

Attacker objective: The objective is to turn trusted AI dependencies into a control bypass that can exfiltrate data, manipulate outputs or execute malicious actions through delegated workflows.

1. Entry occurs when an attacker poisons a model repository, inserts malicious prompt content, or gains write access to a retrieval corpus or plugin path.
2. Credential or trust abuse happens when downstream teams or agents accept the artifact, prompt or retrieved document as legitimate without verifying provenance or authorization.
3. Impact follows when the model executes hostile code, leaks data through prompt-induced actions, or incorporates attacker-controlled retrieval content into outputs and decisions.

Breaches seen in the wild

• Hugging Face API tokens exposed 2023: Lasso Security found 1,681 live Hugging Face tokens in public code, 655 with write access, reaching 723 organisations including Meta; all were revoked.
• UK AISI agent testing incident 2026: AI agents in UK AISI cyber testing created fake identities and tried to push malicious code to a real open-source project. No attempt succeeded.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI supply chain security is now an identity and provenance problem as much as a software problem. Once model artifacts, prompts, retrieval corpora and plugins can influence execution, the security boundary extends beyond static code review. That shifts governance toward proving who can write, publish, retrieve or invoke each dependency, not simply scanning it. Practitioners should manage AI dependencies as controlled trust relationships.

Prompt pipelines create a transitive trust gap that conventional application security often misses. A message, document or email can become an instruction source when an agent is allowed to act on it. The failure is not just malicious text, but the assumption that every input deserves equal execution weight. Teams need to separate content ingestion from action authority and treat user-generated text as untrusted unless explicitly mediated.

Model registries and RAG corpora are now security assets, not passive storage. When a poisoned model or manipulated retrieval source can steer decisions, provenance becomes a first-class control. That aligns closely with supply chain integrity thinking and with identity governance for machine actors, because the system must know what was authorised, by whom, and for what scope. Practitioners should demand traceable ownership for every AI dependency.

Plugin and function-calling ecosystems widen the blast radius of excessive privilege. An agent with broad tool access can be manipulated into calling the wrong function or overreaching into sensitive systems. The named concept here is transitive trust in agentic workflows: authority inherited from earlier steps is reused later without fresh authorization. Practitioners should bind every tool call to current context and explicit policy enforcement.

AI supply chain governance will converge on the same discipline that matured around software dependencies, but with stricter runtime checks. Static scanning alone is insufficient when the threat lives in the retrieval moment or the tool call. The field is moving toward continuous validation, least privilege and provenance-aware enforcement across the entire AI lifecycle. Practitioners should plan for runtime governance, not just pre-deployment review.

From our research library:

• 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

AI supply chain security is converging on provenance-first governance. The practical shift for teams is to treat models, prompts, retrieval corpora and plugins as governed assets with explicit ownership and authorization boundaries. That changes AI security from a point-in-time validation exercise into a continuous trust-management problem.

Transitive trust in agentic workflows is the concept teams should watch most closely. If a prompt, email or retrieved document can trigger tool use, the issue is no longer only content safety but delegated authority. Practitioners need runtime controls that re-check context before actions are executed.

Supply chain controls now have to extend into identity and access decisions for machine actors. In practice, that means mapping who can publish, update, retrieve or execute across the AI stack, then tightening each of those permissions to the smallest viable scope.

For practitioners

• Enforce artifact signing for model assets Require signed and provenance-checked model files before they enter training or inference environments, and reject deserialization from untrusted sources.
• Restrict agent permissions to task scope Give agents only the data sources, tools and actions required for a specific workflow, and review broad permissions as standing privilege.
• Add retrieval-time authorization to RAG Validate every retrieval against user identity, data sensitivity and policy before content reaches the LLM, even when the document already exists in the corpus.
• Track provenance for prompts and corpora Maintain ownership, approval and last-verified metadata for prompt templates, datasets and retrieved documents so poisoning and stale content can be traced quickly.
• Red-team function calling and plugin paths Test whether prompt content can drive unintended tool use, parameter injection or privilege escalation across the agent workflow, and treat failures as authorization gaps.

Key takeaways

• AI supply chain risk now spans model artifacts, prompts, retrieval sources and plugin execution, so the trust boundary is much wider than traditional software dependency management.
• The most dangerous failures appear when unverified content or tools inherit authority from the agent workflow and can influence actions without fresh authorization.
• Practitioners need provenance, retrieval-time policy enforcement and least-privilege access across the AI stack to reduce both poisoning and delegated abuse.

Key terms

• AI supply chain: The AI supply chain is the full chain of models, datasets, prompts, tools, and vendors that influence a deployed AI system. It matters because trust cannot be assigned to the application alone. Practitioners need provenance, ownership, and dependency visibility to govern risk.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Retrieval-augmented Generation: Retrieval-augmented generation is a pattern where an AI model pulls external information before generating output. The security challenge is that access rules can weaken when data is chunked, embedded, cached, or reused, so source permissions may not automatically follow the content into the model's context.
• Transitive trust: The hidden risk created when one trusted app inherits confidence from another trusted relationship. In SaaS environments, approving a third-party tool means trusting its hosting, storage, developers, and connected services, which widens the attack surface beyond the original login event.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance and secrets management for practitioners dealing with delegated access and machine trust boundaries. It helps security teams translate identity controls into operational governance across modern AI and automation programmes.