12 CVEs Indexed - Dependency Security in AI Agent Toolchains
12 CVEs Indexed - Dependency Security in AI Agent Toolchains
You audit your agent's code. You review its permissions. You test its outputs. But have you looked at what its dependencies depend on? Transitive dependencies are where the real vulnerabilities hide.
The Dependency Tree Nobody Reads
A typical AI agent toolchain includes an LLM client library, MCP server packages, browser automation tools, file system utilities, and API wrappers. Each of these has its own dependencies. A single MCP server package can pull in 200+ transitive dependencies.
When was the last time anyone audited those? The answer for most teams is never.
How CVEs Sneak In
A recent audit of a common agent toolchain stack found 12 indexed CVEs across transitive dependencies. None were in the direct dependencies. All were two or three levels deep in the dependency tree - packages that the developers never explicitly chose to include.
The vulnerability path looks like this: your agent uses package A, which depends on package B, which depends on package C, which has a known remote code execution vulnerability. Your agent is vulnerable, but nothing in your direct dependency list shows it.
What to Audit
- Lock files - check your package-lock.json, poetry.lock, or Cargo.lock for known vulnerabilities using tools like npm audit, pip-audit, or cargo-audit
- MCP server dependencies - each MCP server you add is a new dependency tree to audit
- Runtime permissions - which dependencies have file system access, network access, or subprocess spawning capabilities?
- Update frequency - dependencies that have not been updated in 12+ months are more likely to contain unpatched vulnerabilities
Practical Security Steps
Run automated dependency scanning on every build. Set up alerts for new CVEs in your dependency tree. Pin dependency versions to prevent unexpected updates. And most importantly - minimize your dependency count. Every package you remove is an entire sub-tree of transitive dependencies you no longer need to worry about.
The most secure dependency is the one you do not have.
Fazm is an open source macOS AI agent. Open source on GitHub.