Agentic supply chain security puts dependency, execution, and identity controls around AI coding agents. Across PyPI, npm, Maven, and NuGet, Endor Labs found that only 1 in 5 dependency versions recommended by AI coding assistants are safe to use.
TL;DR
AI coding agents select packages, install them, and run package scripts inside development workflows without human review. The dependencies those agents choose carry high rates of known vulnerabilities and hallucinated package names that exist in no registry. Containing agents requires controls they cannot skip: lockfile pinning, package firewalls, sandboxed execution, and least-privilege identity scoped per run.
Agentic supply chain security starts with a mechanical change in dependency governance: AI coding agents can run package scripts during autonomous install paths. An engineer approves an agent's plan, the agent runs npm install, and the preinstall scripts execute before anyone can inspect them. Multiplied across agent sessions in an organization, that install path changes where supply chain controls must operate. Sonatype reported more than 454,600 new malicious packages in 2025 alone, a 75% year-over-year increase.
Traditional controls still matter, but human decision points no longer cover every install path. This guide maps current attack data, the mechanisms agents add, and the agentic supply chain controls that must move before install, into execution, and around identity.
The following table shows where human-driven and agentic workflows diverge on each security decision point.
| Security decision point | Human-driven workflow | Agentic workflow |
|---|---|---|
| Dependency selection | Developer chooses a package before review | Agent selects a package during code generation |
| Install timing | Review can happen before install | npm install can run before inspection |
| Script execution | Pre-install review can catch risky scripts | Preinstall scripts execute automatically |
| Package validation | Human checks existence and vulnerability status | MCP validation tools must check before install |
| Identity scope | Developer credentials often gate the action | Per-agent identity must scope tokens and access |
Run your software agents at scale
Cosmos gives your agents the context, tools, and feedback loops they need to get better with every workflow.
The Scale of Software Supply Chain Attacks in 2025-2026
Software supply chain attacks compromise organizations through consumed components, and the volume has grown every year on record. Sonatype reported that its cumulative count of malicious open source packages passed 1.233 million across npm, PyPI, Maven Central, NuGet, and Hugging Face by the end of 2025. ReversingLabs reported a 73% increase in malicious open-source packages, with nearly 90% of detections concentrated in npm.
The breach data tracks the same curve. The Verizon 2026 DBIR found third-party involvement in breaches reached 48%, up from 30% the prior year. Black Duck's 2026 OSSRA survey found 65% of organizations experienced a software supply chain attack in the past year. Security teams can apply AI security fixes when incidents involve data exfiltration paths, credential exposure, or unsafe agent actions.
September 2025 marked the point when npm attacks moved beyond nuisance-level activity. The table below captures five incidents that follow a common pattern: attackers compromise one trusted package, maintainer account, agent prompt, or credential, then automation distributes the payload faster than manual review can react.
| Incident | Date | Impact |
|---|---|---|
| npm chalk/debug/strip-ansi | September 2025 | Maintainer phishing compromised 18+ packages with 2B+ combined weekly downloads |
| Shai-Hulud npm worm | September 2025 | 500+ packages; first self-replicating registry-native worm |
| Shai-Hulud 2.0 | November 2025 | 25,000+ malicious GitHub repositories |
| Cline compromise | February 2026 | Prompt injected via a GitHub issue title; agent installed on approximately 4,000 developer machines |
| TeamPCP cascade | March 2026 | Five package registries affected in under 30 days, including litellm (95M monthly PyPI downloads) |
How AI Coding Agents Change Software Supply Chain Security
Software supply chain security for agentic development starts from a structural change: the actor choosing dependencies is no longer a human. Endor Labs describes the shift: AI coding agents have evolved from assistants into semi-autonomous systems that write code, install dependencies, and interact with external services. Their State of Dependency Management 2025 quantifies what those agents choose. Across PyPI, npm, Maven, and NuGet, 49% of dependency versions imported by AI coding agents have known vulnerabilities. Another 34% are hallucinated, and those versions do not exist in any registry.
Agents also execute what they install. The Endor Labs security research team confirmed that AI coding assistants executed malicious payloads in every test attempt. Operationally, when agents can install packages without confirmation, in bypass modes or CI pipelines with broad npm permissions, the human verification step is gone.
Package validation through MCP changed the numbers in Endor Labs testing. Agents equipped with package-validation tools improved dependency safety 3x across PyPI, npm, Maven, and NuGet because they checked package existence and vulnerability status before install. Augment Cosmos, the unified cloud agents platform, applies the same kind of check against repository context through its Context Engine, which processes codebases across 400,000+ files through semantic dependency graph analysis. Context Engine compares new dependency choices against components repository teams have already vetted before package changes pass review. The Auggie CLI gates agent-initiated terminal commands before execution with approval and tool permissions for CI/automation.
Slopsquatting: Hallucinated Package Names as an Attack Surface
Slopsquatting is a supply chain attack in which adversaries register the fictitious package names LLMs hallucinate, so that when a developer or agent installs the suggested package, they install malware. The term is a play on typosquatting. The error originates from the AI rather than a human typist. The USENIX 2025 study by Spracklen et al. tested 16 models across 576,000 code samples. The following table summarizes the key findings from that study.
| Finding (Spracklen et al., USENIX 2025) | Figure |
|---|---|
| Overall hallucination rate | 19.7% |
| Unique hallucinated package names | 205,474 |
| Commercial models, average rate | 5.2% |
| Open-source models, average rate | 21.7% |
| Hallucinations repeated in every one of 10 re-runs | 43% |
The 43% repetition rate makes slopsquatting practical. Hallucinations are predictable, so an attacker can observe a small number of model outputs and register the names those models reliably invent. A 2026 replication on five frontier LLMs found lower overall rates of 4.62% to 6.10%. It also identified 53 hallucinated names, 41 on PyPI and 12 on npm, still open for registration as of April 2026.
The attack has moved into published packages. Reporting on the PhantomRaven campaign described 126 malicious npm packages placed against names AI assistants predictably hallucinate; three additional waves later distributed 88 packages, 81 of which remained live on npm at the time of reporting. In one documented case, the hallucinated package react-codeshift propagated through 237 repositories via AI-generated agent skills. Autonomous agents executing their own outputs drove its downloads.
Open Source Security Risk: The Substrate Agents Amplify
Open source security risk is the baseline exposure agents accelerate, because agents draw from the same open source packages humans do, faster and with less scrutiny. Black Duck's OSSRA 2026 audits reported that 98% of codebases contain open source, with a mean of 21,672 components per application, a figure that quadrupled in five years. Sonatype puts open source at up to 90% of modern application code.
Most of that exposure arrives through dependencies developers did not choose directly. Black Duck reported that 64% of components are transitive dependencies that no developer explicitly chose, and nearly half of high- or critical-risk vulnerabilities enter through them. Maintenance data adds four more signals:
- 93% of codebases contain components with no development activity in 2+ years (OSSRA 2026)
- 92% contain components 4+ years out of date
- 80% of application dependencies go un-updated for over a year
- 62% of open source consumers used a vulnerable component version when a non-vulnerable one was already available
Endor Labs' 49% vulnerable-import rate shows how unattended agent installs can repeat stale-version selection as a systems failure before review.
The New Attack Surface: MCP Servers, Extensions, and Secrets
AI supply chain security extends dependency inventory beyond packages. The inventory now covers everything an agent consumes, including models, MCP servers, IDE extensions, and the credentials behind each connection. The table below summarizes the documented risk data across five categories.
| Agentic surface | Documented risk | Control implication |
|---|---|---|
| Model-generated dependency choices | 49% known-vulnerability rate and 34% hallucination rate | Validate package existence and vulnerability status before install |
| MCP servers | 75% individual maintainership and 82% sensitive API use | Catalog servers, scope access per task, and log agent queries |
| IDE extensions and agent plugins | VS Code AI extension malware reached 1.5 million installs | Treat extensions as dependency-like supply chain nodes |
| Prompt injection | GitHub issue titles, package READMEs, and CI text can become instructions | Map delivery paths and constrain agent tool use |
| Secrets | Copilot-active repositories leaked secrets at a 6.4% rate | Use push protection, rotation, and short-lived credentials |
MCP servers: Endor Labs' analysis of 10,663 GitHub repositories implementing MCP servers found that individuals build 75% of them, often without enterprise-grade safeguards, while 82% use sensitive APIs. Tool poisoning attacks have shown how a benign-looking MCP server can swap in a poisoned tool description that steers an agent to exfiltrate data through a separate, legitimate server. CVE-2025-54136 showed attackers could silently swap a trusted MCP configuration in Cursor for a malicious command without re-triggering approval. The Auggie CLI supports MCP server management for remote servers, including OAuth for remote MCP server authentication and streaming output in the agent terminal workflow.
IDE extensions and agent plugins: A malicious PR landed in the Amazon Q Developer VS Code extension and shipped as version 1.84.0 with an embedded prompt instructing the agent to clean a system to a near-factory state and delete file-system and cloud resources. In January 2026, researchers reported malicious VS Code extensions with 1.5 million installs. The extensions exfiltrated source code and .env files.
Prompt injection: Prompt injection reaches agents through package READMEs, GitHub issue titles, CI pipelines, and other text surfaces the agent treats as instructions. The Cline compromise in February 2026 started with a prompt injected into a GitHub issue title and ended with an npm publish token stolen and an autonomous agent installed on roughly 4,000 developer machines. Teams assessing this failure mode can map delivery paths against known prompt injection vulnerabilities.
Secrets: GitGuardian reported that repositories using GitHub Copilot leak secrets at a 6.4% rate, 40% above the 4.6% baseline, and Claude Code co-authored commits showed a 3.2% leak rate against a 1.5% baseline. Public MCP configuration files have exposed over 24,000 unique secrets. The remediation timeline runs much slower than the attack timeline. The Verizon 2025 DBIR puts median remediation of a leaked GitHub secret at 94 days, while the chalk/debug attackers went from account access to malicious payload in about 16 minutes. Remote Agent Secrets injects credentials into agent workflows without writing those credentials into code changes, centralizing secure credential injection. Teams evaluating agent access patterns can compare these controls with private AI coding requirements for regulated environments.
Why SBOMs and Provenance Do Not Close the Agentic Gap
SBOMs and provenance attestation remain necessary, but they fit human-driven builds, and agentic workflows expose four gaps.
- Provenance verifies origin, not intent: A package an attacker registers against a hallucinated name can still look properly published. The attack succeeds through the trust model, not by breaking the provenance chain.
- Runtime installs escape the SBOM: Teams generate SBOMs at build time. Build-time inventories can miss runtime-resolved components, and no standard workflow automatically updates an SBOM when an agent autonomously modifies a dependency manifest.
- No authorship provenance exists for AI-generated code: Build provenance records the build path without capturing which model, version, or system prompt produced a code block. AI Bills of Materials are emerging but non-standardized.
- Agent toolchains are untracked nodes: Common SBOM workflows generally do not model MCP server calls or agent-to-agent delegations as supply chain steps.
SBOMs still enumerate known package inventories and identify what shipped. The agentic gap is that the decision, installation, and execution steps can happen before the inventory is generated or reviewed.
Agentic Supply Chain Security: Controls That Contain Agents
Agentic supply chain security secures the full dependency path that gives an agent its authority and context. That path spans models, prompts, tools, plugins, memory stores, and the credentials behind each connection. Organizations using AI agents need to govern, monitor, and secure those agents as supply chain participants, the same way they secure third-party dependencies and CI/CD integrations.
The following table maps each control to its enforcement mechanism and the extension required for agentic workflows.
| Control | Mechanism | Agentic extension |
|---|---|---|
| Lockfiles, pinning, hash verification | Pin packages to known versions; verify hashes | Blocks slopsquatted installs even when the agent acts autonomously |
| Package firewalls | Intercept installs at the registry boundary (Socket Firewall, JFrog Curation) | Enforcement point that works regardless of who, or what, runs the install |
| CI/CD policy gates | SCA/SAST gates block builds on critical findings | Apply identical scrutiny to AI-generated code; treat every AI-authored function like a third-party import |
| Sandboxed execution | Isolate agent runtime through constrained execution environments | Turns a destructive agent command into a denied operation |
| Least-privilege agent identity | Scoped tokens, time-boxed credentials, file-tree allowlists | Prevents one agent run from inheriting broad human or automation credentials |
| MCP governance | Catalog every MCP server, log every agent query, scope access per task | Closes gaps in server oversight and operational practices |
| Secrets hardening | Push protection, prompt rotation, short-lived OIDC credentials | Contains the blast radius when an agent leaks or harvests a token |
A sandboxed agent holding an over-privileged token can still misuse that token. Sandboxing reduces execution-path blast radius by moving agent commands into isolated runtimes. Credential misuse still requires identity governance, so agent actions need both runtime policy and least-privilege credentials.
The same controls apply when agents open pull requests, call APIs with non-human credentials, or run governed terminal commands. Automated code review gives teams implementing AI-code-parity review a 59% F-score (65% precision, 55% recall). Pull request analysis reviews agent-authored changes against full-codebase context rather than the diff alone. Cosmos Environments scope code, credential, and infrastructure access per agent run, while Service Accounts separate non-human API access from personal developer credentials.
The following table summarizes how each control area maps to the agent action it governs and the enforcement point it requires.
| Control area | Agent action | Enforcement point |
|---|---|---|
| Dependency selection | Agent recommends or edits a package manifest | Package validation and lockfile policy |
| Package installation | Agent runs npm install or equivalent commands | Package firewall and command approval |
| Tool access | Agent calls MCP servers or plugins | MCP cataloging, scopes, and logs |
| Runtime execution | Agent runs terminal commands | Sandboxed execution environments |
| Credential use | Agent reads or injects secrets | Short-lived, least-privilege credentials |
Treat Every Agent as a Supply Chain Participant This Quarter
Agentic supply chain security has to balance speed against scrutiny. Agents increase throughput by skipping manual steps, including approval points security programs relied on. This quarter, enforce lockfiles with hash verification so hallucinated packages fail at install. Move registry checks, MCP inventory, and credential review into agentic workflow implementation practices before autonomous changes reach production.
Agents that can modify code, credentials, or infrastructure need environments where every action emits a structured event. Cosmos Environments define where agents run and what they can touch, while the Event Bus sends structured agent events to software development lifecycle workflows. Cosmos is generally available and included on all paid plans.
Frequently Asked Questions About Agentic Supply Chain Security
These are the questions security and platform teams ask when evaluating how autonomous dependency installation, MCP access, and credential exposure change supply chain controls.
Related Guides
Written by
Molisha Shah
Molisha is an early GTM and Customer Champion at Augment Code, where she focuses on helping developers understand and adopt modern AI coding practices. She writes about clean code principles, agentic development environments, and how teams are restructuring their workflows around AI agents. She holds a degree in Business and Cognitive Science from UC Berkeley.