"The open-source ecosystem spent fifteen years learning that anyone-can-publish is not a trust model. The AI agent ecosystem launched with the same assumption and called it a feature."
The software supply chain was supposed to be a solved problem by now. Not fully solved, but understood. After a decade of incidents, the open-source community built the controls: mandatory two-factor authentication for publishers, cryptographic signing, provenance attestations, coordinated disclosure, and funded stewardship. It took 15 years of painful lessons, but the governance model was taking shape.
Then a parallel ecosystem appeared overnight, and none of those controls came with it.
In April 2026, OX Security published what they called "The Mother of All AI Supply Chains," a systemic architectural vulnerability in Anthropic's Model Context Protocol SDKs affecting an estimated 200,000 servers and 150 million downloads. The researchers disclosed 10 or more CVEs, most rated critical, and demonstrated remote code execution on six live production platforms. But the finding that should keep security leaders up at night was simpler: they submitted a proof-of-concept malicious entry to eleven MCP marketplaces. Nine accepted it with no review. That is npm circa 2011, except the packages have your users' credentials.
A Vectra AI survey of 1,450 practitioners found that 63% of security alerts already go unaddressed on a typical day. The teams wrestling with that volume are now being asked to also govern a new dependency ecosystem where the vetting controls have not been built yet.
We have watched this pattern play out from two different vantage points. Tushar Badlani is a Security Specialist at Figma, focused on Customer Trust and Third Party Risk. Mohit Bansal is a Senior Manager of Security Engineering at Webflow. Between us, we have spent the last several years building and operating the controls that sit between third-party code and production environments. What we see forming in the AI agent ecosystem is not a new category of risk. It is the same category, stripped of every control the industry spent two decades building.
The npm supply chain attacks of 2025 and 2026 tell a specific story when read in sequence. Each incident defeated a control that the previous one respected. The progression matters because it maps directly onto what the AI agent ecosystem is about to face.
In August 2025, an attacker compromised the NX CLI through a misconfigured GitHub Actions workflow and weaponized local AI developer tools—including Claude, Gemini, and Amazon Q—to scan for secrets. There was nothing to verify and nothing to fail. That was the starting line.
By September 2025, Shai-Hulud introduced self-replication to npm. Once inside a maintainer's account, the worm republished itself across the victim's top packages, compromising roughly 200 packages in its first wave. Palo Alto Unit 42 assessed with moderate confidence that an LLM generated the bash payload. A second wave that November, dubbed Shai-Hulud 2.0, hit several hundred more packages. Both waves still relied on stolen credentials and had no provenance to fake.
In February and March 2026, the attacks escalated. An actor compromised Trivy, the widely-used security scanner from Aqua Security, by exploiting a pull_request_target misconfiguration and force-pushing 76 of 77 trivy-action tags to credential-stealing malware. That compromise then cascaded into LiteLLM, an AI gateway present in roughly 36% of cloud environments, because LiteLLM's CI pipeline ran the poisoned Trivy action. The security tooling itself became the supply chain weapon.
Then came the moment the trust model broke. In May 2026, attackers compromised 84 malicious versions across 42 TanStack packages in a six-minute window. The team had 2FA enabled. No credentials were stolen. The attackers chained three GitHub Actions weaknesses to publish through the legitimate build pipeline. The result was the first documented npm attack carrying valid SLSA Build Level 3 provenance. Sigstore correctly attested the build. It just happened to be signing the attack.
One week later, a compromised NX Console VS Code extension fetched a payload containing full Sigstore and Fulcio integration. Per StepSecurity's analysis, combined with stolen npm OIDC tokens, the attacker was positioned to forge valid provenance on downstream packages. VentureBeat reported 633 malicious npm versions passed Sigstore provenance verification on May 19.
Read that sequence again. No provenance, then self-replication, then weaponizing the scanner, then valid provenance signing the attack, then forged provenance. Each rung of the ladder defeated the control that stopped the rung before it.
The AI agent supply chain is not somewhere in the middle of this progression. It is at the very beginning: the stage where anyone can publish anything and the distribution channels do not check.
MCP, the Model Context Protocol, is how AI agents connect to external services. Anthropic open-sourced it in November 2024, donated it to the Linux Foundation in December 2025, and it now has co-stewardship from OpenAI, Google, Microsoft, and AWS. The ecosystem has grown from roughly 100 servers at launch to more than 10,000 active public servers and 97 million monthly SDK downloads by the end of 2025. A Nerq Q1 2026 census indexed 17,468 servers, of which only 12.9% scored "high trust." Trend Micro counted 7,000 internet-exposed MCP servers by April 2026, up from 1,467 in October 2025.
But the growth rate is not the problem. The governance gap is.
The npm registry took seven years after launch to introduce optional two-factor authentication in 2017. Mandatory 2FA for top packages did not arrive until 2022. Cryptographic signing with ECDSA replaced PGP in July 2022. Provenance attestations via Sigstore reached general availability in October 2023. Trusted publishing with OIDC landed in July 2025. And classic tokens were not revoked until December 2025—15 years after npm launched.
Those controls are the floor. They are the minimum viable governance for a software supply chain. And the AI agent ecosystem has none of them.
Skills, plugins, and MCP servers get loaded dynamically at runtime based on what the agent decides it needs. That is a design strength for usability, but it means that most of the supply chain security tooling enterprises already own does not see any of this traffic. A malicious open-source library runs with whatever access the program it is part of has. A skill runs inside an AI agent that already holds your users' permissions: their email, their calendar, their files, their internal systems. When nine of 11 MCP marketplaces accept unvetted submissions, and the packages those marketplaces distribute inherit agent-level credentials, the blast radius of a single malicious entry is categorically larger than a poisoned npm package.
In June 2026, a security firm built a harmless fake AI agent skill, got it past Cisco and NVIDIA security scanners, promoted it via a skill marketplace and an Instagram ad, and reportedly reached approximately 26,000 agents, including some on corporate accounts. The evasion technique was not novel. The skill passed static review, then loaded its payload from a mutable external link the scanners never rechecked. It is the same bait-and-switch that plagued browser extensions and package ecosystems for years.
The OWASP Top 10 for Agentic Applications, published in December 2025 with input from more than 100 experts and endorsements from NIST and Microsoft, includes ASI04: Agentic Supply Chain Vulnerabilities. The distinction it draws is important. This is not the static, pre-deployment supply chain problem from the LLM Top 10. This is dynamic runtime composition, where agents discover and load components during execution. The attack surface is fundamentally different because the inventory changes with every invocation.
The supply chain governance gap would be serious on its own. Paired with the current remediation crisis, it becomes urgent.
On March 27, 2026, HackerOne paused new submissions to its Internet Bug Bounty program, which had been running since 2013 and had awarded more than $1.5 million to open-source security researchers. The reason was straightforward: AI-assisted research was expanding vulnerability discovery faster than open-source maintainers could fix what was being found. The balance between discovery and remediation capacity had, in HackerOne's framing, "substantively shifted."
The cascading effects arrived quickly. Node.js paused its own bounty program because it relied on IBB funding. Curl exited HackerOne entirely in January 2026 over what its maintainer called "AI slop." Google stopped accepting AI-generated vulnerability reports in March 2026. The Linux Foundation announced a $12.5 million security funding push backed by Anthropic, AWS, GitHub, Google, DeepMind, Microsoft, and OpenAI.
The pattern here is consistent. Discovery scales with compute; remediation does not. And the AI agent ecosystem is inheriting that asymmetry from day one, without the governance infrastructure that the open-source ecosystem spent 15 years building to at least partially compensate.
Our security programs treat agent integrations the way we treat any high-risk third-party dependency: pre-deployment risk assessment, credential lifecycle tracking, runtime behavioral monitoring. The common thread across all of the incidents in this piece is that the agent inherits permissions from its host environment, and neither the marketplace nor the protocol enforces meaningful constraints on what those permissions allow. The teams that recognize this early tend to build the inventory and the enforcement before the incident forces it.
The good news is that the controls themselves are not a mystery. Signing, verification, inventory, scoped permissions, runtime visibility, funded stewardship—the open-source community already proved what works. The question is whether the AI agent ecosystem will adopt those controls proactively or learn the same lessons through the same painful sequence of incidents, compressed from years into months.
The tools to address this exist. Provenance attestation is not experimental. Publisher verification is not a research problem. Runtime inventory of dynamically loaded components is achievable with current infrastructure. What is missing is the decision to apply the same governance rigor to an AI agent skill that gets applied to an npm package. And the window for making that decision, while the standards are still being written and the ecosystem is still small enough to influence, is narrower than it looks.
The teams that will be in the strongest position 12 months from now are the ones building the inventory today, treating every MCP server and agent skill as untrusted third-party code, and engaging with the standards bodies while the governance model is still being drafted. It is easier to shape a standard that is 18 months old than one that is 15 years old. That advantage will not last.
This article was co-written by Mohit Bansal.