Software supply chain risk used to have a fairly contained definition: open-source packages, build pipelines, and the occasional compromised maintainer account. AI agents have changed that. An agent assembles capability at runtime, pulling in models, MCP servers, libraries, code, tools, skills, and plugins, then acts on its findings. Agents operate at machine speed in parallelized workflows at speed and volume far greater than those of human-paced developers.

This differs from the dependencies CIOs have long governed. An agent’s tool catalog can change the day after approval, and the agent will trust whatever shows up the next time it looks. OWASP now includes Agentic Supply Chain Vulnerabilities (ASI04) in its Top 10 for Agentic Applications, describing risks that “arise when agents, tools, and related artifacts they work with are provided by third parties and may be malicious, compromised, or tampered with in transit.”

Here are five things technology leaders must understand about the agentic supply chain as agents become part of enterprise operations.

1. An agent can inherit the trust of something it connects to

When an agent calls a tool or connects to an MCP server, it absorbs that component’s context and ability to action into its own reasoning. Integrating an MCP server establishes a trust relationship that affects every connected agent.

That trust can travel through plaintext instructions and metadata in addition to code. An attacker doesn’t need to compromise a tool’s implementation to compromise the agent using it. A tool’s description (the metadata an agent reads to decide how and when to call it) is enough to influence how an agent reasons about and invokes that tool. Hiding an instruction inside a text description can be enough for an agent to follow it.

It isn’t enough to review the tool description before approving. You must review what the tool, and everything the tool talks to, is doing on every call after that.

2. Traditional supply chain security can’t see this layer

Dependency scanning, SBOMs, and code review were built to catch risk in artifacts that don’t change once they ship. MCP servers, tools, and skills don’t work that way; they’re discovered and called at runtime. CrowdStrike research on agentic tool chain attacks makes the gap explicit: Dependency scanning has no visibility into tools that evolve outside the deployment pipeline.

OWASP describes the same shift: Agentic ecosystems “often compose capabilities at runtime … thereby increasing the attack surface.” Agents pulling models, skills, and plugins from the internet expand the risk profile of shadow AI.

Individual tools and descriptions can change independently of the application deployment process, allowing agent behavior to change without a traditional software release gate. Security researchers call this a rug pull: a tool that passes review, then changes after deployment. OWASP recommends pinning tools and configurations by content hash and rolling back automatically when the hash drifts.

3. Attackers are exploiting the agentic supply chain

In September 2025, Koi Security reported what it called the first malicious MCP server found in the wild. An attacker copied a legitimate open source project and quietly added a line to their new version that bcc’d every email the tool sent to an attacker-controlled address. The package drew around 1,500 downloads before its developer deleted it from npm, but this action didn’t remove it from systems that already had it installed.

In August 2026, a worm targeting the keyv/cacheable npm ecosystem went after developers, eventually poisoning 1,684 versions across 420 package names. In July 2026, a researcher-filed GitHub security advisory disclosed an MCP tool in nginx-ui that created a direct path to remote code execution.

All three exploit the same gap: components that agents and AI coding tools load and run automatically. The common thread is reach. Each incident turned something an agent or developer tool could touch (outbound email, repo configuration, a live web server) into an attacker’s foothold.

4. Agent marketplaces and registries multiply the exposure

As agents pull skills and plugins from third-party marketplaces, the exposure scales with the catalog. Antiy’s research into the OpenClaw skill marketplace identified 1,184 malicious skills that had appeared there over time, with a single author account responsible for 677 of them.

Marketplace presence, popularity, and ranking shouldn’t be treated as evidence that an agent component is trustworthy. Once agents pull capability from open registries at scale, “who approved this skill” stops having one answer.

5. Securing the agentic supply chain means tracing the whole chain

A poisoned tool doesn’t stay a tool problem. Scanning the tool at the moment it’s approved says nothing about what it does six months later.

CISA and Australia’s ASD, in joint guidance on adopting agentic AI, break the resulting risk into five categories you can use as a starting checklist: privilege risks, design and configuration risks, behavior risks, structural risks, and accountability risks. Each maps to a question the agentic supply chain raises: What can this component do, how was it configured, how does it behave, how is it wired into everything else, and who’s accountable when it goes wrong?

CrowdStrike frames the work in a similar sequence: Discover the AI agents running, secure the agent supply chain feeding them, establish continuous identity for what they do, then detect and respond to what happens at runtime. Securing the supply chain is one stage in that sequence.

With agents, the dependency chain remains live at runtime. The software supply chain doesn’t end anywhere: Every tool, skill, and MCP server an agent uses can change for as long as the agent keeps running.

CrowdStrike Falcon® Guardian brings AI detection and response (AIDR) to the endpoint, where AI agents execute, providing visibility into the agents operating across endpoints, the resources and systems they interact with, and what they do at runtime. When a supply chain component introduces risk, Falcon Guardian helps teams see what the agent did, investigate what happened, and respond before the threat spreads.

Learn more: Explore CrowdStrike AI Agent Security resources to see how organizations can secure the agentic supply chain and the broader AI estate.

For decades, the technology industry was built around supply chains that were global, but highly concentrated and fragile.

The shifting geopolitical landscape in recent years necessitated an evolution of these supply chains that, on the surface, seem more diversified — but are no less fragile.

Instead of strengthening them, certain aspects of tech supply chains were relocated in ways that created a far higher cost per unit of output.

The result? Supply chains that only relocate fragility while remaining highly concentrated.

This phenomenon poses a threat to the entire tech industry as companies are now paying to run more complex and redundant supply chains while remaining exposed to the same chokepoints as before.

Global reach is not the same as diversification

Let’s clarify something: while the tech industry’s supply chains are often described as global, calling them concentrated occurs less frequently.

Various countries were involved, but each had their own specific task. Advanced logic predominantly came from Taiwan, assembly and most non-chip components came from mainland China — and the equipment to make them came from a short list of vendors in the US, Japan and the Netherlands.

Each of these stages represented concentrated points of potential failure along a highly dependent supply chain.

That structure rested on a political premise as much as an economic one. Concentration created deeper interdependence — which was assumed to be stabilizing since countries that supplied each other’s critical inputs seemingly had too much to lose from interrupting the flow.

However, that understanding has been tested in recent years. Interdependence is increasingly perceived as leverage rather than insurance, and export controls made the shift explicit.

Now, a chokepoint is an instrument that a government may choose to use — and tech supply chains began evolving as more actors used this leverage.

Recent trade data clearly shows this evolution.

The most notable shift happened after the US-China trade war in 2018. China’s share of US electronics imports fell from 52% in 2018 to 37% in 2022 — a 29% decrease in just four years.

In servers, China’s share of global supply fell from over 90% before 2018 to below 50% by 2022. Conversely, the Association of Southeast Asian Nations (ASEAN) saw its share rise from 17% in 2018 to 26% in 2022.

In 2025, Vietnam and India surpassed China in share of US smartphone imports, and Vietnam surpassed China in share of US laptop imports.

Marko Markov

This shift in trade and the evolution of tech supply chains manifested itself in two main ways:

• Companies moved final assembly production to new countries to minimize risk.
• Governments incentivized production domestically as a way to maximize security and boost economic growth.

While both of these developments were a response to the changing landscape, neither fully addressed the true fragility that decades of concentration have developed.

What is actually moving?

The simplest part of a tech hardware supply chain to move is final assembly. Its primary input is labor and there is not much fixed equipment that needs to be moved.

Countries benefiting from this shift include Vietnam, India, Thailand and Mexico — who all became final assembly hubs and imported greater shares of components from China.

What has not moved is most of what makes the product possible.

Chip fabrication depends on machines only a handful of companies globally know how to build — and on engineers who are scarce everywhere.

Advanced packaging is still overwhelmingly done in East Asia, while specialized components carry their own factories, approvals and suppliers behind them.

None of this can be easily relocated.

What results is an industry that has spent heavily on relocating the layer that was never really the vulnerability, while the concentration of key components remains.

Marko Markov

Governments strike back

Governments around the world reached this same conclusion.

The high-value component layer stayed in place because relocation costs were too high.

A leading-edge fab costs tens of billions of dollars and years to build — a risky investment in a world of increasing disruptions. Very few companies acting commercially would move that layer.

However, the rise of geopolitical uncertainty in recent years — the 2018 US-China trade war, the COVID-19 pandemic, Russia’s invasion of Ukraine in 2022 and the ongoing war in the Middle East — have made governments more inclined to create incentives to move high-value components domestically.

This is where the CHIPS and Science Act factors in as an incentive designed to make an uneconomic location economic.

Whether this is working or not depends on what you are measuring. In May 2024, the Semiconductor Industry Association projected that US fab capacity will grow by 203% by 2032 and that the US will make up 28% of global chip capital expenditures between 2024-2032 — estimated to be approximately $650 billion.

This looks like a success on the surface, but that same report suggests this expenditure and growth will only result in the US share of world chip manufacturing increasing from 10% to 14% by 2032.

Essentially, a quarter of the world’s chip investment results in an increase of four percentage points of output. This suggests that relocating high-value components is far more challenging — even with large sums of government investment.

China, meanwhile, is funding a domestic industry built to run without Western technology. Its third chip fund, launched in 2024, targets high-value components with support totaling $47.5 billion.

Both countries are strongly incentivizing a future industry where high-value components are concentrated domestically in an attempt to create a more secure supply chain.

More complexity at the end of the day

These efforts by companies and governments only added complexity to supply chains instead of removing it.

Companies moved assembly, but not high-value components. Governments are attempting to move high-value components, but with mixed results and within their own borders.

What’s changed?

A wafer made now (or in the future) could be made in Arizona, travel to Asia to be packaged and then return stateside again to be assembled. This ultimately creates more steps, more borders and more paperwork in an already complex supply chain.

That is redundancy that increases costs for technology companies.

TSMC put a number on this when it told investors that running fabs outside Taiwan will reduce gross margin by two-to-three percentage points, widening to three-to-four percentage points as those plants scale.

Most firms would have no cushion. A majority of contract manufacturers work on thin gross margins; when their costs rise, the money most likely needs to come from the customer’s price.

As technology buyers, companies need to start preparing for a world of higher prices — but none of this means the reorientation was a mistake.

A supply chain running through a single strait, a handful of foundries and a short list of tool vendors was a real risk. No business or political leader who lived through 2020 and 2021 was going to sit on their hands, especially as the boom in the promise of AI has provided more pressure on supply chains.

So, what has all this change provided? So far, it’s been an evolution of movement more so than resiliency.

Final assembly relocated because final assembly was always the least expensive thing to move. The layers of concentration that actually constrain the industry — fabrication, advanced packaging and the specialized components that carry their own supplier networks behind them — have barely shifted.

When governments do move them, it’s predominantly through large incentives that have mixed results. The US and China, the world’s two economic superpowers, are now funding separate systems built to avoid depending on each other — and neither is less concentrated and less fragile than before.

Meanwhile, companies suffer from increased supply chain complexity that’s accompanied by increased prices.

The deeper issues remain ingrained in the system — and those in the tech industry should stop mistaking a redrawn map for a rebuilt supply chain.

Nvidia will use Palantir’s Foundry software to analyze its global network of suppliers and partners for supply chain risks — and Palantir will incorporate Nvida’s Nemotron open AI model into its existing AI software stack.

The deal will enhance both companies’ offerings, they said: Nvidia will use Palantir’s AI stack to optimize its complex supply chain ecosystem, helping teams identify potential constraints, evaluate alternatives more quickly and allocate materials based on end-to-end production impact. The companies are already close partners.

At the same time, they said, Nemotron will bring more supply-chain visibility to the platform that Palantir sells to other companies, enabling its customers to build their own AI stacks by training Nemotron with their own data. They will be able to use the system to manage supply constraints and assess trade-offs.

Nvidia CEO Jensen Huang highlighted the complexities of the supply chain involved in building modern AI data centers, saying, “Nvidia and Palantir are transforming this vast operational graph into sovereign intelligence — combining Nvidia Nemotron models with Palantir’s Ontology to reason, plan and orchestrate the journey from wafer to token.”

The news release announcing the deal was riddled with references to sovereignty, a concern for enterprises as governments attempt to unwind decades of globalization and build to a new world order based on coercion rather than cooperation.