AI Tool and Plugin Supply Chain Risk Assessment

The supply chain surface for AI agents

AI agents typically use external tools in two ways: (1) outside services (APIs) the agent calls while running, and (2) plugins or extensions added to the agent's software or a developer's coding tool. Both represent supply chain risk. A compromised tool provider can slip harmful behavior into agent actions without any change to the agent's own code.

AI-generated code is a newer supply chain risk. When developers use AI coding assistants to write code that goes into production software, security flaws can creep in. Causes include the AI model's training data (which may include malicious examples), reasoning errors, or prompt injection (hidden instructions planted to hijack the AI) in the development environment. This code should be treated as untrusted supply chain input.

Tool and plugin assessment checklist

Provenance and maintainership

• Is the publisher known and verifiable? Is there a clear organizational owner?
• Is the plugin actively maintained? When was the last update?
• Can the source code be inspected (open source), or is it hidden?

Data access and exfiltration risk

• What data does the tool receive? Can it see inputs that include regulated or sensitive data?
• Does the tool send data out over the internet? To where?
• Is data retained by the tool provider? Under what terms?

Update and versioning policy

• Does the tool auto-update? If so, does the update introduce new capabilities or data access without re-assessment?
• Is there a way to lock the tool to a specific version?

Incident history

• Has the tool been involved in a security incident?
• Does the provider publish security advisories (public notices of flaws and fixes)?

AI-generated code controls

• Commit tagging: Require developers to label each commit (a saved code change) that contains AI-generated code. This can be enforced via a commit hook (an automatic check that runs when code is saved).
• Differentiated review: AI-generated code should require at least one human reviewer who actively read and tested the code rather than approving based on the developer's description.
• Dependency scrutiny: AI models frequently suggest using outside code libraries. Require that AI-suggested dependencies (outside code the software relies on) are assessed against the standard dependency vetting process before adoption.
• Secret scanning: Apply secret scanning tools (which detect passwords and access keys) to AI-generated code before commit; AI models occasionally reproduce passwords or keys seen in training data.