Authoritative source for the official definition of ASI04, the six vulnerability types (poisoned prompt templates, tool-descriptor injection, impersonation/typosquatting, vulnerable third-party agents, compromised MCP/registry servers, poisoned knowledge plugins), the six attack scenarios, and the nine mitigation categories. The OWASP PDF is the canonical source for the distinction between static and dynamic supply chain attack surfaces, and for the "live supply chain" characterization of agentic ecosystems. Used throughout this module.

Basis for Scenario 1. The Amazon Q VS Code extension version 1.84.0 was found to contain code that exfiltrated developer credentials. Distributed through the official VS Code marketplace with a valid signature, demonstrating that authenticated distribution channels are not sufficient to prevent supply chain attacks on agentic tooling. Referenced in slides 14 and 19.

Basis for Scenario 2 and the deep-dive in slides 10–11. Invariant Labs demonstrated that hidden instructions embedded in GitHub issue content — invisible to humans but processed by LLMs — could cause an AI coding assistant (using the GitHub MCP server) to exfiltrate private repository contents. This research established the "tool data supply chain" as an attack surface distinct from user-sent prompt injection. Referenced in slides 10, 11, and 14.

Basis for Scenario 3 and the deep-dive in slide 12. The first documented malicious MCP server found in a public registry. Published on npm under a name impersonating the legitimate Postmark email API MCP server, with matching API signatures and documentation. The server secretly BCC'd all outgoing emails to an attacker-controlled address. Referenced in slides 6, 12, and 15.

Basis for Scenario 4. Demonstrated that a compromised prompt hub — shared infrastructure used by multiple agents to load prompt templates — could act as a proxy, exfiltrating all data (prompts, responses, retrieved documents, user inputs) passing through it. Highlights the amplification risk of shared agent infrastructure components. Referenced in slides 13 and 15.

Basis for Scenario 5 and the opening story in Slide 1. A malicious version of a widely-used npm package was published; AI coding agents autonomously installed it during routine dependency resolution. The payload read SSH keys, environment variables, and API tokens and exfiltrated them. Demonstrates how agent autonomy removes the human review checkpoint that might otherwise catch supply chain attacks. Referenced in slides 1, 5, 13, and 16.

Referenced in the MIT01 slide (19) on provenance verification and SBOMs. SPDX (ISO/IEC 5962:2021) and CycloneDX are the two primary machine-readable SBOM standards. CycloneDX is specifically extending its schema to support AI/ML components (AIBOM), including model weights, training datasets, and agentic tool manifests.

EO 14028 mandated SBOM adoption for federal software procurement, driving industry-wide SBOM adoption. Establishes the regulatory context for MIT01 (provenance verification and SBOMs). Provides background for why SBOM practices are becoming standard requirements rather than optional security practices.

Referenced in Slide 2 as the canonical pre-agentic software supply chain attack. A build server was compromised, inserting a backdoor into signed SolarWinds Orion software updates distributed to ~18,000 organizations. Establishes the historical context for supply chain attacks and demonstrates that signature verification and authenticated distribution channels are not sufficient when the signing infrastructure itself is compromised.

Background for the MCP ecosystem attacks (Scenarios 2, 3, 6). MCP is the open protocol defining how AI assistants connect to tools, resources, and data sources. The rapid growth of the MCP ecosystem — and the emergence of malicious MCP servers published to npm — makes MCP server authentication (MIT05) and allowlisting (MIT02) critical. Referenced in slides 6, 10, 12, 13, 15, and 23.

Background for Scenario 6 (Agent-in-the-Middle via agent cards). Agent cards are the metadata documents used in A2A communication for agent discovery and routing. The A2A protocol specification and the agent card format are the technical basis for the PKI/signature verification approach in MIT05. Referenced in slides 13, 16, and 23.

Provides the broader secure software development context for supply chain mitigations. SSDF practices PW.4 (reuse existing, well-secured software) and RV.1 (identify and confirm vulnerabilities) inform the dependency gatekeeping (MIT02) and continuous validation (MIT06) controls described in this module.