Topic starter
09/07/2026 9:33 am
TL;DR: AgentMesh is joining VirusTotal's Crowdsourced AI program to add behavioural analysis for MCP servers, AI skills and VS Code extensions, surfacing prompt injection, typosquatting, unexpected network behaviour and secret exfiltration patterns in the agentic software supply chain, according to Knostic. The signal is clear: agent tooling now needs supply-chain-style inspection because traditional signature-based controls are too slow for fast-moving AI components.
Editorial analysis by NHI Mgmt Group, based on content published by Knostic: “Knostic’s AgentMesh Joins VirusTotal's Crowdsourced AI Program”.
Key questions
Q: What breaks when an MCP server or extension is trusted without behavioural inspection?
A: The trust model breaks because the component can look legitimate at install time while still carrying prompt injection, typosquatting or secret-exfiltration behaviour at runtime.
Q: Why do agentic AI tools create more supply chain risk than standard plugins?
A: They create more risk because they can influence decisions, call services and interact with secrets inside a live workflow.
Q: What are the signs that AI agent access is becoming unsafe in enterprise environments?
A: Common warning signs include broad standing permissions, unclear ownership of agent credentials, excessive access to multiple data domains, and weak logging around agent actions.
Practitioner guidance
- Inventory every agent-facing component Catalogue MCP servers, AI skills, coding-agent tools and VS Code extensions that can influence production workflows or touch credentials.
- Inspect for prompt injection and malicious behaviour Scan tool descriptions, responses and metadata for embedded instructions, typosquatting signals, unusual network activity and secret-exfiltration patterns before allowing enterprise use.
- Treat delegated access as a governed NHI path Review which non-human identities, tokens and API keys an agent can reach through each tool, and remove standing access that is not required for the task.
Bottom line: Agentic AI supply chain threats are no longer theoretical because toolchains that power agents can also deliver prompt injection, typosquatting and secret exfiltration.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 9:35 am
Agentic supply chain security is now an access-control problem, not only a code-trust problem. Once MCP servers, skills and extensions can influence prompts, trigger network calls or touch credentials, they become part of the identity perimeter. That makes provenance useful but insufficient, because the real issue is whether the component can exercise delegated authority inside a live workflow. Practitioners should treat AI tool ingestion as a governed trust decision, not a software-installation event.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should teams govern non-human identities in AI-heavy environments?
A: Teams should govern non-human identities the same way they govern other privileged assets: assign ownership, minimise scope, rotate credentials regularly, and monitor for abnormal use. The key difference is speed. AI-driven workflows can exploit exposed access quickly, so detection and revocation must be automated and tied to lifecycle controls.
👉 Read our full editorial: Agentic AI supply chain threats are moving into security workflows