HighAgenticAgent Supply-Chain Compromise●Realized
Plugin & Dependency Integrity Failure
Tool & Affordance RiskDescription
Compromise of upstream components (plugins, MCP servers, APIs, libraries, pre-trained models) cascades into agent behaviour at scale. Low-code agent platforms with ~90% third-party dependency create massive supply-chain attack surface.
Example scenario
Malicious MCP server published to a popular registry contains a backdoor exfiltrating all data the agent processes.
Real-world evidence●Realized
Multiple active litigation cases confirm that training data provenance and composition are undisclosed in production AI systems, resulting in confirmed copyright and privacy violations. Regulators in the EU and US have issued formal findings on data transparency failures in deployed AI.
Primary mitigations
- SBOM maintenance
- third-party dependency vetting
- signed plugin verification
- isolated sandbox testing
- runtime integrity checking.
Detection signals
Trusted Dependency Integrity Score; unsigned dependency detection rate.
Mitigating controls
7 Dual coverage
ZYC-MCP-01Agentic
MCP Server Approval Registry + Typosquat Check
Tool & MCP Governance
ZYC-SCS-01Agentic
AI component SBOM and integrity verification
Supply Chain Security
ZYC-SEC-003Non-Agentic
Access Control
Security
ZYC-SEC-009Non-Agentic
Code Execution Defense
Security
ZYC-SCV-001Non-Agentic
Third-Party component risk
Supply Chain Vulnerabilities
ZYC-SCV-002Non-Agentic
Vulnerabilities
Supply Chain Vulnerabilities
ZYC-PRIV-001Non-Agentic
PII Detection and Classification
Privacy & Data Governance