AI Plugin and Connector Supply Chain Risks

An enterprise that approves an AI model but never looks at the plugins, connectors, and skills wired into it has only approved a fraction of what actually runs in production. But the model is one component sitting inside a much larger stack, and the Cloud Security Alliance's work from September 2026 traces a direct line running from model artifacts through MCP servers, skills, plugins, and agent configuration, with each layer shaping what the agent decides and does on its own terms. A plugin can quietly install a skill, and that skill can pull in instructions from an outside source, then call an MCP tool with the employee's own login, so if you approve the top package, you still don't know whether its dependencies, its instruction sources, or its downstream actions deserve that same trust.

What gets lost when approval stops at the model is the fact that a single sign-off is being asked to cover three separate questions. What data and systems can the agent reach, and what actions can it actually take; that is a third. Verifying where a component came from only tells part of the story. It leaves the agent's authority almost entirely unexamined, and that's the gap where the bulk of enterprise AI governance programs currently sit.

Attack surfaces introduced by MCP servers, skills, and plugins

MCP servers are the connective tissue between an agent and the outside world, giving it reach into files, databases, APIs, and live execution environments. The sharpest edge of that surface is the tool description itself, the plain-language text that tells the agent what a tool does and when to use it. The model reads that description and treats it as an instruction to follow, as inert metadata sitting off to the side. So ordinary-looking documentation becomes a lever an attacker can pull.

But skills work differently, and they create a blind spot of their own. Scan only the Markdown, and the executable payload sitting next to it slips through entirely. Neither inspection method alone covers the full package, and security teams that pick one over the other are only ever looking at half the picture.

Plugins raise the stakes again, because a plugin can bundle skills, hooks, commands, agents, scripts, and MCP servers all behind one installation prompt. Approving a plugin means approving everything stitched inside it, whether the reviewer realizes that or not, and a single install decision ends up carrying the full attack surface of every component riding along with it. Each of these three layers compounds the others rather than sitting neatly beside them, and that layering is what makes the next question so pressing: how does an attacker actually turn these surfaces into something exploitable?

Four attack techniques that exploit these surfaces in production

The techniques built around AI plugin and connector infrastructure target something specific to agentic systems. They don't rely purely on code bugs. They exploit the way agents trust, interpret, and act on natural-language descriptions in the first place.

Tool poisoning hides malicious instructions inside an MCP tool description, and once that description ships inside a package, a configuration file, or a remote server, it fires silently on every invocation, across every session, for every user, until someone finally catches it. Traditional prompt injection needs repeated delivery to keep working. Tool poisoning doesn't, because the instruction lives permanently in something the agent consults every time it reaches for that tool.

Rug pulls take a slower route. The MCP specification offers no built-in way to track whether a tool definition has changed, and no mechanism forces a re-approval when it does.

So one malicious server in that mix can inject tool descriptions that redefine how the agent understands its other, trusted tools, and the blast radius of a single compromised server spreads across the entire connected toolset.

The fourth pattern turns the coding assistant itself into the exfiltration channel. When an AI coding assistant loads a project-level skill or MCP server carrying hidden instructions, it carries them out as part of what looks like completely normal operation, so secrets get pulled out without the developer ever running anything that looks like a suspicious binary. Nothing about the assistant itself is broken in this scenario. It's doing what it was built to do, just against the person who trusted it.

You can see how fast this scales in the Miasma Worm campaign from June 2026, once an IDE auto-executes whatever configuration it finds. Malicious MCP configuration files turned up across 73 GitHub repositories, including Microsoft Azure's azure/durabletask project, and any developer who simply opened one of those repositories in a vulnerable IDE triggered a credential-harvesting payload, no warning, no extra click required beyond opening the project. TrapDoor, disclosed in May 2026, worked a similar angle with more disguise: hidden instructions were embedded in AI coding assistant configuration files using zero-width Unicode characters, turning the developer's own assistant into the exfiltration tool by running what looked like a routine security scan while actually harvesting secrets. That campaign opened pull requests against browser-use/browser-use, langchain-ai/langchain, langflow-ai/langflow, run-llama/llama_index, FoundationAgents/MetaGPT, and OpenHands/OpenHands to spread the poisoned configs further.

Confirmed 2026 supply chain incidents and their real-world impact

The 2026 incident record settles any question about whether these attacks are theoretical. They're already causing confirmed data loss, and they leave backdoors in production systems, with credential compromise at real scale.

ClawHavoc, running from late January into February 2026, is the largest of these confirmed to date. Nine CVEs came out of it, and three already have public exploit code attached.

Plugin4Shell, disclosed by the security firm Air Security in September 2026, hit Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI all at once. Anthropic and OpenAI patched their agents. GitHub Copilot stayed unpatched, and Google declined to fix the issue in its retiring Gemini CLI.

The STDIO transport at the center of the flaw took incoming configuration and passed its parameters straight to the host operating system's shell without sanitizing any of it first.

Tenet Security's testing around Sentry's MCP integration found a high rate of agent execution in organizations running injectable DSNs, a pattern reaching thousands of organizations. Postmark-MCP, back in September 2025, ran fifteen clean versions before version 1.0.16 silently began copying every outgoing email to an attacker, proving that a long, clean version history guarantees nothing about what a future release will do. And between December 2025 and February 2026, an AI-directed attack compromised Mexico's federal tax authority, its electoral institute, three state governments, and a water utility, pulling millions of taxpayer records and a substantial volume of other data out in the process.

Different agencies, different companies, different components exploited, but the pattern holds across every one of them: point-in-time approval never caught a change that happened after the approval was granted. The gap between point-in-time approval and continuously changing components is the structural problem.

Point-in-time approval's structural inadequacy for components that change after installation

None of this traces back to carelessness on the part of any one security team. A component gets reviewed once, at the moment of installation or connection, but its tool definitions, its scripts, its dependencies, and the content it references can all keep changing long after that review is finished.

Postmark-mcp makes the point as clearly as any example could. The approval that teams relied on was made about an artifact that no longer existed by the time the dangerous version shipped.

Rug pulls exploit this exact gap on purpose. Because the MCP specification has no built-in way to track changes to a tool definition and no mechanism that forces re-approval when one changes, an agent just keeps calling a tool whose actual meaning has shifted underneath it, with nobody in the loop to catch the shift. That timing gap gets worse the faster AI adoption outpaces governance. The absence of that visibility is itself a risk sitting on the books, whether or not anyone has written it down yet.

It's also worth considering that the component doesn't even need to be compromised for this failure mode to play out. In a GitHub MCP demonstration, malicious instructions buried inside a public issue caused an agent to pull information out of a private repository and publish it through a public pull request. The integration itself was legitimate the whole time, and the agent had every permission it needed to do what it did. The failure came from combining untrusted content with an agent that had both sensitive read access and the ability to write out to the public internet.

You could argue that better developer hygiene solves most of this without needing any protocol redesign. There's something to that: cleaner code review habits do address quality problems sitting inside individual servers. But hygiene alone doesn't touch the timing gap, and it doesn't build in a re-approval mechanism for when a tool definition changes after the fact. A one-time decision, made under conditions that existed at a single moment, cannot account for every input, every tool sequence, or every destination an agent might reach afterward. That's the exact problem the next layer of controls has to solve.

Controls that address post-approval change across the plugin and connector stack

Closing that gap takes controls built around artifact provenance, runtime instruction monitoring, and execution authority together, in place of the install-time review that most programs still lean on as their only line of defense.

Artifact trust controls are a necessary starting point, but they stop short on their own. MCP server package versions should be pinned and reviewed, and agent configuration paths belong inside the standard code review process, not off to the side of it. Auto-approval settings for new MCP server connections need to be turned off outright: the Cursor IDE auto-execution pattern is a direct illustration of why granting automatic trust to a newly added server entry invites exactly the kind of silent compromise described earlier. Environments should be scanned regularly for exposed MCP endpoints, with particular attention paid to any unauthenticated bindings sitting open.

Most programs still miss instruction trust. Review has to cover the whole package, meaning code, external references, and natural-language instructions together, because scanning only the scripts misses instruction-layer manipulation, and scanning only the Markdown misses the executable payload sitting beside it. Tool descriptions belong in the same security review bucket as code, not filed away as harmless metadata, because the model itself treats that text as instruction. Persistent memory and retrieval sources deserve the same scrutiny, because a poisoned document or a stored instruction can keep shaping an agent's decisions across sessions long after whatever introduced it first.

Execution trust is where the continuous part of continuous monitoring actually has to live. Organizations need a working map of which workflows depend on which AI providers and connectors, and not having that map is itself a material risk sitting unaddressed. Least privilege belongs on every agent's tool permissions, because what an agent can reach sets the outer boundary on how bad any single compromise in its tool chain can get. Agent configuration deserves treatment as security-sensitive logic in its own right, the same weight given to application code, since it defines which tools are available, what tasks get carried out, what gets approved automatically, what memory persists, and how execution actually unfolds. Behavioral monitoring of agent actions, covering every tool the agent can invoke and not just the model generating the output, is what actually catches a post-approval change that a one-time static review was never built to see.

Underneath all of this sits a broader inventory problem. AI-BOM visibility is becoming a core requirement, and that inventory needs to stretch well past software packages to cover training datasets, pretrained model checkpoints, prompt templates, inference pipelines, external APIs, and fine-tuning configurations, components that change dynamically and are rarely tracked by traditional SBOMs.

Regulatory frameworks, a risk management framework, and a management-system standard assigning accountability for the supply chain layer

Every control described above answers to a widening set of regulatory expectations, and each framework pulls the supply chain layer into scope in its own way. A regulator asking whether an organization has adequately governed its AI system is, by extension, asking about the plugins, connectors, and agent configuration that system depends on to function, because none of those pieces operate outside the system's actual behavior.

A framework asking organizations to "map," "measure," and "manage" risk on an ongoing basis has little patience for a governance model that stops checking the moment a plugin gets installed. So if you treat approval as a one-time event, you work against a framework built entirely around the idea that risk conditions keep shifting.

Enterprises that vet AI models but not the surrounding stack are approving a fraction of what actually runs. An organization that can produce a model card but can't produce an inventory of its MCP servers, its skills, and its plugin dependencies has a visible gap in exactly the kind of documentation these standards expect.

None of these three frameworks name MCP servers, skills, or plugins directly. But the obligations all of them impose, continuous risk monitoring, full-system accountability, documented governance that covers the whole stack, point straight at the layer this piece has spent its length describing. The regulatory language may still be catching up to the specific vocabulary of agentic AI. The expectation that accountability covers the full stack, not just the headline model, is already built into how each of these frameworks is written.