As we sit in the middle of Cybersecurity Awareness Month, we’ve talked about supply chain attacks recently. But there’s one part of the chain that still gets overlooked, largely because it’s new.
MSPs have spent years learning to scrutinize the vendors with keys to their clients’ castles: the RMM platforms, backup tools, and identity providers. That discipline is hard-won and necessary. But there’s a new category of vendor that has walked into those same environments largely unvetted, and many MSPs haven’t noticed yet.
It’s not a software company. It’s the AI assistant sitting in a client’s browser, along with the tool servers it’s quietly calling on the other side.
The supply chain is changing
Kevin O’Connor, a cybersecurity practitioner and researcher at EQTYLAB, an AI governance and cryptographic attestation firm, tells Smarter MSP that the supply chain problem has fundamentally changed shape.
“AI is making software supply-chain attacks cheaper to scale and harder to spot,” he said. “Attackers can use it to produce more convincing malicious packages, phishing lures, pull requests, and fake maintainer activity, while organizations are rapidly introducing AI agents into repositories with access to code, CI/CD workflows, and secrets.”
The implication, he said, is structural: “The supply chain is no longer only the vendors and libraries you trust. It now includes the automated systems allowed to act on their behalf.”
The attack patterns O’Connor is tracking aren’t theoretical.
“AI is widening the repository attack surface in two ways,” he said. “It helps attackers produce convincing malicious packages, pull requests, and maintainer impersonation at scale, while AI agents embedded in development workflows can be manipulated through untrusted issues, comments, documentation, or dependencies.”
A repository, he noted, is no longer just source code. “It’s also instructions, automation, credentials, build systems, and increasingly an agent with authority to modify files.”
A new attack surface for AI assistants
Serhii Nikolaichuk, founder of Vault Genome at The Capital Index and an author of IETF Internet-Drafts on remote attestation, identifies a channel many MSPs may not yet be monitoring. The Model Context Protocol (MCP) allows AI applications to connect to external tools, data sources, and services. OWASP identifies MCP as introducing new security risks, including tool poisoning, excessive permissions, data exfiltration, and supply chain attacks.
“The compromise does not look like a breach,” Nikolaichuk said. “A tool returns text; the text carries instructions; the assistant, holding the client’s valid credentials, does as it is told. No perimeter is crossed, because the agent was invited in.”
That’s the scary part: the agent was invited in. Not through a security review or vendor assessment, but potentially by an employee connecting an AI assistant to a work account. They may never consider what tool servers it’s calling or who approved them. Most clients, Nikolaichuk said, have no answer to that question.
“Every MSP can produce a list of its software vendors. Almost none can say which tool servers their clients’ assistants called yesterday, who approved each one, or how fast a poisoned one can be cut off.”
Treat AI tools like third-party vendors
O’Connor connects this directly to the MSP’s existing vendor risk responsibilities. “MSPs need to treat AI-enabled development tooling as a third-party risk relationship,” he said. “If an agent, plugin, or workflow can install code, read credentials, modify a repository, or publish a release, it should be inventoried, constrained, logged, and subject to rapid revocation, just like any other privileged vendor connection.”
The standard he’s describing is the same one Article 1 of this series applied to RMM platforms and backup tools. The difference is that the same scrutiny may not yet be applied consistently to AI.
Nikolaichuk sees that gap as a concrete service opportunity currently unclaimed in much of the MSP market. Not “AI security” as a marketing slogan, he said, but three specific deliverables an MSP can build and sell now. “An inventory of every tool server each client’s assistants can reach,” he said. “A named human approver for each. And a measured revocation time, when you pull a tool server or a credential, how many seconds until it actually stops working.”
That last metric is the one he said nobody in the industry currently publishes, including the vendors themselves. “An MSP that measures it for its clients is selling something no competitor has on the menu.”
The next vendor risk conversation
MSPs have seen this vendor risk before, but AI makes it faster and harder to see. “Attackers now have automated systems allowed to act on behalf of trusted vendors,” O’Connor said. “If you haven’t asked whether an AI agent in your client’s environment can install code or read credentials, and whether you could revoke that access in seconds if something went wrong, you have a vendor you’ve never vetted sitting inside every environment you manage.”
The question Nikolaichuk poses is a good one for every MSP to ask before the next client conversation:
“Which tool servers did your clients’ AI assistants call yesterday?”
If the answer is “I don’t know,” that’s the gap. And closing it, he said, is exactly the kind of work a good MSP should be doing before an attacker does it for them.
Photo: Che Yeen / Shutterstock
This post originally appeared on Smarter MSP.