Tag
supply-chain
13 entries, including 2 patterns.
A hallucinated package name is an open registration
Coding models invent dependency names, and they invent the same ones again. An attacker does not need to guess what your agent will install. They sample the model, find the names nobody owns, and register them first.
A poisoning budget does not scale with the corpus
Defenders assumed a bigger training set dilutes an attacker's samples. Anthropic, the UK AI Security Institute and the Alan Turing Institute found that about 250 documents backdoored models from 600M to 13B parameters, and the larger model saw twenty times more clean data.
A skill's prerequisites section is the payload
ClawHavoc filled an agent skill marketplace with polished documentation that ended in "install this first." The malware was never in the skill's code. It was a sentence the user, or the agent, was expected to follow.
The issue body ran with the maintainer's token
PromptPwnd found AI agents in CI that paste issue titles and pull request bodies straight into the prompt, then run with a write token and a shell. The attacker needs only a GitHub account and the ability to open an issue.
The MCP server added one BCC
The first widely reported malicious MCP server in the wild did not exploit the agent. It was a working email tool that, from one release on, quietly copied every message to the attacker.
The trusted config was the one the attacker could write
Two Cursor vulnerabilities targeted the same file. One let a prompt injection write a new MCP server into it without approval. The other let a repository swap an already-approved entry for a different command. In both, the config was the payload.
A checkpoint is not inert data
Loading a pickle-based model file runs whatever the file tells the unpickler to run. Attackers have shipped reverse shells on Hugging Face that fire on load, and one campaign broke its own file so the scanner errored after the payload had already executed.
- Pattern
Source-Bound CI Attestation
Treat a passing PR check as an attestation from a designated runner about an exact revision, not as a green string any repository writer can supply.
The green check came from the wrong writer
A coding agent's PR can carry a passing status for a test it never ran when the merge gate trusts the check name but not its issuer.
- Pattern
Quarantine Unreviewed Installs
Let PR validation execute lifecycle hooks only in a worker whose credentials, network and output cannot become release authority without review.
The install step ran the pull request
An agent's code-review transcript may be clean while a dependency install executes repository-controlled code before the first test.
A retrieved chunk is not a data point
RAG poisoning turns your own retriever into the injection vector. A chunk that ranks top-k for a benign query is data to the pipeline and instructions to the model — and nothing in the stack can tell the difference.
The LLM API reseller is the new bulletproof host
The South Korea ARTEX campaign reached DeepSeek through xcai.pro, a proxy reseller. That one hop is why attribution and blocking both fail, and it is the supply-chain gap nobody is watching.