Secrets, dependencies and network isolation

An agent system is assembled from parts other people made: Python and npm packages, base images, open-weight models and tokenisers, a hosted model behind an API, MCP servers, skills, guardrail models, CI actions. Each part can be swapped, tampered with or simply changed under you. Supply-chain security means you know exactly which parts you ship (pinned versions, hashes, an SBOM that includes models and datasets), you can prove where they came from (signatures and provenance), and you refuse to load formats that run code on open (pickle) unless you have scanned and signed them. Secrets live in a vault, reach the runtime as short-lived values, and never appear in prompts, config files, repositories, images or logs; scanners check for them at commit, in CI and in images. The network is the last line: agent runtimes and sandboxes get no ambient internet, only a default-deny egress policy with an owned allow-list, private endpoints to model providers and systems of record, and logs of what was blocked. The security team will ask for the scan output, the SBOM, the lockfile and an egress test. Have them ready before they ask.

Key takeaways:

• The agent supply chain includes models, MCP servers, skills and prompts, not just packages. Inventory all of them.
• Pin everything by version and hash. A version tag can be republished; a hash cannot.
• Pickle files are programs. Prefer safetensors; never load untrusted pickles; scan and sign any exception.
• A secret in a prompt is a secret in your logs, your traces and possibly the model's next reply.
• Default-deny egress turns a successful prompt injection from a data breach into a blocked-connection alert.