Slide 4 · The Definition Part 2
The live supply chain — why agents face a threat that traditional software doesn't
Traditional software has a static supply chain. Agents have a live one. That difference is everything.
📄 OWASP Top 10 for Agentic Applications 2026 · ASI04
"Unlike traditional AI or software supply chains, agentic ecosystems
often compose capabilities at runtime — loading external tools and
agent personas dynamically — thereby increasing the attack surface.
This distributed run-time coordination — combined with agentic
autonomy — creates a live supply chain that can cascade
vulnerabilities across agents."
Dependencies declared at build time. You know exactly what's in the build before it ships.
One-time install. Package is installed, verified, and stays static until deliberately updated.
Human reviews changes. A developer approves dependency updates before they're applied.
Blast radius is bounded. A compromised package affects the specific app that installed it.
Capabilities composed at runtime. The agent discovers and loads tools, plugins, and sub-agents while running — often without a human in the loop.
Continuous live connections. MCP servers, tool registries, and external APIs are live connections that can change at any moment.
Agent trusts descriptors. The agent decides what to use based on text descriptions — which can be forged or poisoned.
Cascades across agents. A compromised tool can propagate malicious instructions through a pipeline of agents, each trusting the output of the last.
The cascade problem
In a multi-agent pipeline, a poisoned component doesn't just affect the agent that loaded it. Its malicious output becomes the input for the next agent — which treats it as trusted internal data. That agent's malicious output becomes the next agent's input. A single compromised component at the start of a pipeline can cascade its attack through every downstream agent.