Agentic Supply Chain Compromise

Exposure

Agentic Supply Chain Compromise occurs when an AI coding agent resolves a dependency, loads a configuration file, processes a symlink path, reads a model cache entry, or executes a tool invocation from a source that an external attacker controls.

Unlike traditional software supply chain attacks, the agentic variant includes new vectors: trust dialogs that misrepresent the operation being approved, symlink resolution races in plugin directories, and MCP tool results that bypass output filters.

CVE and disclosure history (2026)

• GHSA-wpqr-6v78-jr5g (April 2026) — Google Gemini CLI CVSS 10.0. An external attacker triggers full supply chain compromise from a public GitHub issue. Pillar Security disclosure.
• SymJack (May 2026) — Symlink-hijack RCE in six AI coding agents simultaneously. Adversa AI disclosure.
• TrustFall (May 2026) — One-click RCE through trust dialog regression affecting Claude Code, Cursor, Gemini CLI, GitHub Copilot. Adversa AI disclosure.
• MemMorph (June 2026) — In-memory prompt override through attacker-controlled memory files.

Attack scenarios

• CI pipeline injection: Attacker opens a GitHub issue with crafted payload. The agent reads the issue as context, the payload becomes part of a tool call, the tool call executes with CI credentials.
• Plugin directory symlink race: Attacker creates a malicious MCP server config at path resolution time. The agent loads it as a trusted plugin. All subsequent tool invocations route through the attacker.
• Memory file override: Attacker writes to a shared memory file. The agent loads the corrupted memory block as system instruction. Policy enforcement depends on the content of attacker-controlled data.

Impact

Full compromise of the agent execution context: repository secrets, model API keys, deployment credentials, and downstream systems that the agent can access through its tool set.