Supply Chain Compromise
- Tools & External Data
- Memory / State
A compromised component — a model, adapter, library, tool, MCP server, prompt template, or build environment — is drawn into the agent, letting an attacker manipulate its actions, exfiltrate data, or run arbitrary code without ever interacting with the agent directly.
What it is
Supply chain compromise promotes Supply Chain (LLM03) from a model-development concern into a first-class agentic threat, because an agent's supply chain is far wider than its base model: every tool it can call, every MCP server it connects to, every library, adapter, prompt template, and build step is a component whose compromise the agent inherits at runtime. Added as a standalone threat in the v1.1 taxonomy, it captures the reality that the components an agent assembles itself out of are pulled dynamically, often from public or third-party sources, and trusted implicitly once loaded — so a poisoned or backdoored component doesn't announce itself, it simply becomes part of what the agent is, and stays wrong until provenance is independently verified. In a multi-agent system the blast radius widens again: a compromised shared tool or MCP server is reachable by every agent that loads it, so one poisoned component can steer the whole system rather than a single agent.
Kinds
- Tampered models, adapters & libraries
- A model, LoRA adapter, or dependency pulled from a repository carries a hidden backdoor or vulnerability, undetectable by static inspection.
- Malicious tools, MCP servers & metadata
- A tool or MCP server the agent installs is malicious or has had its metadata tampered with, so ordinary tool use becomes the attack.
- Poisoned prompts & remote configuration
- A prompt template or configuration loaded from a remote source is altered to embed exfiltration or backdoor logic the user never sees.
- Poisoned build environment & malicious updates
- A compromised build pipeline or a malicious auto-update injects harmful components into an otherwise-trustworthy agent at assembly or refresh time.
Attack scenarios
A prompt template silently loaded from a remote source is poisoned so an enterprise co-pilot begins "helpfully" auto-suggesting steps that exfiltrate customer data during routine workflows, with no user-visible sign the component was tampered with.
Poisoned tooling update (Amazon Q class)
A poisoned developer-tooling update ships an injection that instructs an AI coding agent to "wipe the system," reaching every user who auto-updates before the release is pulled.
Over-trusted tool chain (Replit class)
A vibe-coding agent with a compromised or over-trusted tool chain deletes a production database while appearing to perform a routine operation.
Malicious package (LiteLLM PyPI class)
A malicious package published to a public registry is downloaded tens of thousands of times in a few hours before removal, each install seeding a backdoored dependency into the agents that pull it.
Tampered MCP server
A tampered MCP server distributed as a convenience integration advertises a benign capability while its implementation exfiltrates every credential the connecting agent holds.
Mitigations
- Sign artifacts and track a bill of materials
- Digitally sign models, tools, and agent components, maintain a verifiable SBOM / AIBOM / Agent SBOM, and verify hashes and provenance on anything pulled from a repository before it loads.
- Restrict and vet what an agent can assemble
- Install tools and MCP servers only from an attested Tool Registry, restrict untrusted tool installation, and apply version control with peer review to prompt templates and configuration rather than loading them blindly from a remote source.
- Isolate every component
- Run agents and their loaded components in sandboxed, isolated environments per Sandbox Execution, so a compromised component can't reach the host or the broader network.
- Monitor for drift and red-team the chain
- Continuously monitor for behavioral drift or malicious change across the supply chain, and red-team the agent with simulated supply-chain attacks to validate the defenses before an adversary does.