Security Weekly - A CRA Resource: You Don't Know What Code You're Running

An AI system includes more than its underlying model. Agent-based systems may also depend on MCP servers, agent-to-agent (A2A) connections, plugins, and skills. Each component can have its own version and update cycle.



Without a reliable inventory of these dependencies, teams may struggle to identify what changed or verify which code is actually running. Pinning a version helps establish expectations, but teams also need to manage updates and verify their dependencies. An overlooked component can introduce unexpected behavior or security exposure.



How should organizations track, verify, and update every component in an AI agent's supply chain without slowing development?



Subscribe to our podcasts: https://securityweekly.com/subscribe



#AISecurity #SupplyChainSecurity #AIEngineering #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec