The core threat: Agentic supply chains are live — agents compose capabilities at runtime, creating a continuous attack surface that traditional build-time supply chain security was never designed to address.

Six vulnerability types: Poisoned prompts and tool descriptors, impersonation/typosquatting, compromised third-party agents, hijacked MCP/registry servers, poisoned knowledge bases, and agent-in-the-middle via forged agent cards.

Six real scenarios: Amazon Q VS Code, GitHub MCP descriptor poisoning, Postmark MCP impersonator, AgentSmith prompt-hub proxy, poisoned nx/debug npm package, and A2A agent card hijacking.

Nine mitigations in three layers: Verify (provenance/SBOM, allowlisting, secure prompts, mTLS, hash pinning), Limit (sandboxing, kill switch, zero trust), Watch (continuous validation).