The collection of models, tools, plugins, MCP servers, prompt libraries, and dependencies that make an agent function. It matters because compromise or misconfiguration in any linked component can alter agent behaviour and expand attack surface.
Expanded Definition
Agent supply chain refers to the full chain of components that an autonomous software entity depends on to plan, decide, and act: models, tools, plugins, MCP servers, prompt libraries, APIs, orchestration code, and third-party dependencies. In NHI and agentic AI governance, the term is broader than traditional software supply chain because the agent’s behaviour can change when any linked component changes, even if the core application code does not.
Definitions vary across vendors on where the boundary ends. Some teams include only externally sourced services, while others also treat internal prompt templates, vector stores, and policy files as supply chain assets. The practical security question is the same: every dependency that can influence agent output or execution must be traceable, versioned, and reviewed. That maps closely to the OWASP OWASP Top 10 for Agentic Applications 2026 and the governance lens in the NIST AI Risk Management Framework.
The most common misapplication is treating only the model provider as the supply chain, which occurs when teams ignore tool connectors, prompt sources, and MCP infrastructure that can silently alter agent actions.
Examples and Use Cases
Implementing agent supply chain controls rigorously often introduces review overhead and slower release cycles, requiring organisations to weigh agent flexibility against the cost of dependency vetting.
- A customer support agent uses an MCP server, and a misconfigured plugin exposes privileged ticketing actions to a low-trust workflow.
- A code assistant inherits a compromised prompt library entry, causing it to recommend unsafe deployment steps or leak secrets into generated output. NHIMG’s Analysis of Claude Code Security shows how fast AI-assisted workflows can amplify weak guardrails.
- An internal agent depends on a third-party retrieval tool, but the tool’s API key rotates without inventory updates, breaking availability and masking access drift.
- A finance workflow agent integrates a new model endpoint, and the vendor update changes refusal behaviour in a way that bypasses a prior approval gate. The OWASP Non-Human Identity Top 10 helps frame the identity and credential risks around such components.
- An agentic app consumes a community MCP package, and hidden dependencies introduce unauthorized telemetry or command execution paths.
These patterns are visible in NHIMG reporting on real-world agent incidents, including the CoPhish OAuth Token Theft via Copilot Studio, where connector trust and delegated permissions became the attack path.
Why It Matters in NHI Security
Agent supply chain risk is an NHI problem because agents rarely act alone. They act through secrets, delegated tokens, service accounts, and tool credentials, so a weak dependency can become a privilege escalation path. NHIMG research shows how quickly this becomes operationally serious: 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, showing that the first year of widespread adoption already created a large attack surface. That aligns with the broader pattern described in the The State of Secrets Sprawl 2026, where AI-related credential leaks surged and exposed infrastructure outpaced security guardrails.
Governance failures here usually start as inventory gaps, but they become incident response problems when an agent starts using an unapproved tool, a stale secret, or a poisoned prompt source. The right control set includes dependency inventory, provenance checks, least privilege, secret rotation, and continuous validation of tool behavior against policy. Standards and threat models such as the CSA MAESTRO agentic AI threat modeling framework and MITRE ATLAS adversarial AI threat matrix help teams translate this into operational checks.
Organisations typically encounter agent supply chain risk only after a tool compromise, prompt tampering event, or secret leak, at which point the term becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Covers secret handling and identity dependencies that agent supply chains inherit. |
| OWASP Agentic AI Top 10 | A2 | Addresses untrusted tools, plugins, and external actions in agentic systems. |
| NIST AI RMF | Frames AI system lifecycle risk management, including provenance and dependency governance. | |
| NIST Zero Trust (SP 800-207) | SA-5 | Zero trust requires continuous verification of service-to-service and agent-to-tool access. |
| CSA MAESTRO | Provides threat modeling for agent workflows, tools, and external action paths. |
Inventory and rotate all agent-linked secrets, then remove any standing privilege from tool credentials.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 15, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
