A supply chain is every upstream dependency your system relies on — packages, libraries, models, plugins, data sources, APIs. A supply chain attack compromises one of those dependencies before your system ever uses it. You install what you trust. What you trust is already poisoned.

Software supply chain attacks have existed for decades. SolarWinds (2020) is the famous example: a build server was compromised, and a backdoor was inserted into signed software that thousands of organizations downloaded and installed as a routine update.

The "agentic" part changes the threat in three important ways:

1. Agents compose capabilities at runtime. A traditional app's dependencies are declared at build time. An agent can discover and load new tools, plugins, and sub-agents dynamically — while it's running. Every new connection is a live supply chain event.

2. Agents act autonomously. A human installing a poisoned package might notice unexpected behavior. An agent installs it, runs it, and acts on its output — without a human in the loop to catch anomalies.

3. Agents trust descriptors. Agents decide what to use based on tool names, descriptions, and metadata — text that can be forged, poisoned, or injected with hidden instructions.

Vulnerabilities in this context means every point in the supply chain where a compromised, forged, or malicious component can enter the agent's execution environment — and the attack surface created by the agent's autonomous, trust-dependent nature.