Agentic Supply Chain Compromise

Domain

Supply Chain

Agent

Mechanism

Supply Chain

Injection

Boundary

Between external artifacts and agent execution

Trigger

An attacker-controlled artifact is resolved by the agent (plugin, symlink, model cache, CI trigger)

Consequence

Code executes with the agent's privileges; supply-chain authority

Required evidence

• Artifact provenance and integrity records
• Plugin and tool resolution allowlist
• Resolution policy and CI trigger audit

Exposure

Agentic Supply Chain Compromise occurs when an AI coding agent resolves a dependency, loads a configuration file, processes a symlink path, reads a model cache entry, or executes a tool invocation from a source that an external attacker controls.

Unlike traditional software supply chain attacks, the agentic variant includes new vectors: trust dialogs that misrepresent the operation being approved, symlink resolution races in plugin directories, and MCP tool results that bypass output filters.

CVE and disclosure history (2026)

• GHSA-wpqr-6v78-jr5g (April 2026) — Google Gemini CLI CVSS 10.0. An external attacker triggers full supply chain compromise from a public GitHub issue. Pillar Security disclosure.
• SymJack (May 2026) — Symlink-hijack RCE in six AI coding agents simultaneously. Adversa AI disclosure.
• TrustFall (May 2026) — One-click RCE through trust dialog regression affecting Claude Code, Cursor, Gemini CLI, GitHub Copilot. Adversa AI disclosure.
• MemMorph (June 2026) — In-memory prompt override through attacker-controlled memory files.

Attack scenarios

• CI pipeline injection: Attacker opens a GitHub issue with crafted payload. The agent reads the issue as context, the payload becomes part of a tool call, the tool call executes with CI credentials.
• Plugin directory symlink race: Attacker creates a malicious MCP server config at path resolution time. The agent loads it as a trusted plugin. All subsequent tool invocations route through the attacker.
• Memory file override: Attacker writes to a shared memory file. The agent loads the corrupted memory block as system instruction. Policy enforcement depends on the content of attacker-controlled data.

Impact

Full compromise of the agent execution context: repository secrets, model API keys, deployment credentials, and downstream systems that the agent can access through its tool set.

Provenance

SOURCE

• OWASP Top 10 for LLM Applications 2026 ↗ external_authority
• MITRE ATLAS ↗ external_authority

MAPPED

Not recorded

ANALYZED

Not recorded

UNRESOLVED

Not recorded

Last reviewed: Sep 20, 2026