**AI agent security needs a composition graph, not just an SBOM**

> Your SCA scanner can find vulnerable packages. It can't tell you those packages are wired into an AI agent that reads your chat messages, sends files, and is governed by skills that can rewrite its access policy. Blog · June 23, 2026 · Vinod Kone Your Agent Risk Isn't in One Plugin. It's in the Composition. Your SCA scanner can find vulnerable packages. It can't tell you those packages are wired into an AI agent that...

**来源信息**
- **来源**：Hacker News：AI 热帖
- **分类**：ai-products
- **发布时间**：2026-06-24 00:53（北京时间）
- **原文**：[打开原文](https://openaca.dev/blog/your-agent-risk-is-in-the-composition)