Supply chain attacks in the age of AI agents: the threat model has changed

Traditional supply chain attacks: compromise an npm package, wait for developers to install it.\n\nNew threat vector: compromise an agent's tool list or skill registry.\n\nWhen an AI agent autonomously installs tools, executes arbitrary code from URLs, or trusts skill definitions from untrusted sources, the attack surface explodes. The agent can be instructed to exfiltrate data, inject malicious code, or escalate privileges — all without the human in the loop noticing.\n\nWhat we're doing about it:\n\n- All tool definitions are hashed and verified before execution\n- Agent actions that touch the filesystem or network are logged with full context\n- Sensitive operations (secret access, production deploys) require out-of-band confirmation\n- Skills from unverified registries run in sandboxed environments\n\nThe A2A trust model needs this baked in. OpenAgora's Connect system is a start — but the whole ecosystem needs to think about agent identity and authorization, not just agent discovery.