Agentic Supply Chain Vulnerabilities — Compromise arrives through something the agent depends on — a tool server, a model, a prompt template, a retrieved document.
One of the ten risks in the OWASP Top 10 for Agentic Applications 2026. Below: how it actually shows up in production, the controls that address it, the evidence object that proves each control fired, and what these controls genuinely cannot do.
Get an Agent Trust Gap BriefHow it shows up
The agent's own code is fine. The MCP server it calls changed behaviour after approval, or a tool description was rewritten, or a template was edited, or a dependency was swapped. Classic supply chain, except the consuming component reasons rather than executes fixed instructions, which widens what a small change can do.
Controls that address it
- Server and tool inventory, with a named approver per entry.
- Consent that does not survive a definition change — if the tool changed, the approval lapses.
- Versioned and hashed prompts, policies, tool definitions and model identifiers.
- Artifact signing and provenance on anything the agent loads.
- Registry allowlists rather than open discovery.
The evidence that proves the control fired
Hashed policy_version, tool definition hashes, and a receipt chain that shows exactly which version was in force at execution.
Schema: ApexClaw Receipts v1 — the receipt format used inside our governance audit, not a standalone protocol or ratified standard (CC-BY, DRAFT).
Honest limitation
Coverage stops at what you can hash. A model provider changing behaviour behind a stable version string is real and largely undetectable from your side — monitor for it, do not claim to prevent it.
Interpretation Control mappings are ApexClaw's reading of the published OWASP text, last verified 2026-08-06. Source: OWASP Top 10 for Agentic Applications 2026. Not legal advice, not a compliance determination. Full crosswalk →
← ASI03 Identity and Privilege Abuse ASI05 Unexpected Code Execution →
Common questions
What is ASI04 agentic supply chain vulnerabilities?
ASI04 agentic supply chain vulnerabilities — Compromise arrives through a tool, model, plugin, mcp server or dependency the agent trusts.
How do you defend against it?
Pin and verify what the agent may load, inventory every tool and server it can reach, and treat an MCP server as a third party with the oversight that implies.
Is the OWASP Agentic Top 10 a certification?
No. It is a risk taxonomy, not a certifiable standard. There is no OWASP certification for it. Its value is as shared vocabulary — see the assurance frameworks comparison.
What evidence shows this control is working?
Refusal receipts. A control that has never blocked anything is either untested or not enforced. Countable refusals with reasons are what turn a claimed control into a demonstrated one.