Unlike a static dependency tree, agents discover and compose components at runtime: tool registries, MCP servers, prompt templates, and peer agents. A poisoned tool description or a rogue MCP server can inject instructions or exfiltrate data from every agent that connects to it.
Maintain an allowlist of approved tools, MCP servers, and agent integrations; pin versions and verify signatures; review tool descriptions for hidden instructions; and run third-party components in sandboxes with minimal network access.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2026Latest
#04asi04-2026 Agentic Supply Chain Vulnerabilities
