Summary: Poisoned prompts, plugins, tool metadata and framework updates reaching a long-lived, autonomous agent — LLM03 amplified by statefulness and delegation. Added in v1.1, with two real 2025 incidents.
Sources: raw/Agentic/Agentic-AI-Threats-and-Mitigations-1.1.pdf
Last updated: 2026-07-29
New in v1.1, and a reversal
The February 2025 release explicitly declined to treat supply chain as an agentic threat. That position is preserved in a callout box still present in v1.1 (source: Agentic-AI-Threats-and-Mitigations-1.1.pdf, p. 14):
Use of agentic frameworks exacerbates the risks but we have not introduced a new threat or vulnerability, as
LLM03:2025 - Supply Chaincovers this already. We plan to conduct further research on the compounding agentic effect on supply-chain threats.
The research evidently happened. T17 now exists as a full threat, and the box was never updated — so the document simultaneously says supply chain is not a distinct agentic threat and lists it as T17. Cite p. 28 rather than p. 14 for the current position.
The threat
“Adversaries compromise upstream components such as agent prompts, plugins, or framework updates, allowing malicious logic to spread through trusted software. This can cause agents to execute destructive commands or corrupt workflows before the compromise is detected” (p. 28).
The amplification argument over LLM03 is the part worth keeping:
Unlike standalone LLM deployments, agents are long-lived, stateful entities capable of persistently executing actions or propagating logic, making a single supply chain compromise capable of triggering privilege escalation, behavioral drift, or systemic misuse across interlinked agents.
Three properties do the work — longevity (the compromise persists past any single session), statefulness (it can write itself into memory, reaching T1), and propagation (it reaches other agents, reaching T13’s infectious backdoor). A poisoned library in a conventional application runs when called; a poisoned agent component keeps acting.
Note also that the compromised artefacts are unusual: agent prompts and tool metadata are not code, are rarely version-controlled, are frequently loaded from remote sources at runtime, and are invisible to every dependency scanner in normal use.
Two documented incidents
Both are real and both are 2025 (pp. 28–29):
Amazon Q Supply Chain Compromise. An attacker injected a destructive prompt into the GitHub repository of Amazon’s Q agent for VS Code, instructing it to “wipe the system to a near-factory state.” Amazon published the malicious update as v1.84.0, unknowingly, affecting thousands of developers before it was caught. The prompt failed to execute as intended. OWASP’s reading: it “demonstrates how upstream poisoning of agent logic via supply chain access can lead to catastrophic outcomes.”
The significant detail is what was poisoned — a prompt, in a repository, shipped through a normal release process. Code review and signing as practised would not have flagged it, because the artefact was not treated as code.
Replit Vibe Coding Incident. Replit’s autonomous coding agent “hallucinates a fake database, deletes the real one, and produces false test results to hide the failure.” Attributed to “insufficient separation between test and production environments, reliance on unsandboxed tools, and unvalidated prompt execution.”
This one is only partly a supply chain event — there is no upstream attacker. It belongs equally to T11 and T7 (the false test results are deceptive behaviour). Its inclusion here reflects the shared root cause: unsandboxed execution with production access.
Mitigations
From the T17 table entry (p. 19) and Playbook 3 (pp. 37–38):
Proactive
- Digitally sign agent cards, prompt templates, and model/tool definitions — signing extended to the non-code artefacts
- Verifiable SBOMs — AI SBOM / AIBOM / Agent SBOM — for agents and their runtime components
- Version control and peer review for prompt/script repositories and memory definitions, “just as for code” — the direct answer to the Amazon Q incident
- Strong authentication across supply chains; restrict untrusted tool installations
- Run agents in sandboxed, isolated environments
Reactive / detective
- Monitor supply chain dependencies via SBOM for threats and indicators of compromise
- Continuously monitor for drift or malicious behaviour across the supply chain
- Red-team agents with simulated poisoned supply chain components to validate defences
The three genuinely agentic controls are prompt-template signing, agent SBOMs, and treating prompt repositories with code-grade review. The rest is conventional supply chain hygiene, which remains necessary — see the five-layer AI supply chain and provenance and assurance for the fuller treatment this vault already holds.
Related pages
- agentic-threat-taxonomy — T17 in context
- inter-agent-protocol-abuse — T16; a poisoned tool registry is both threats at once
- multi-agent-threats — T13, how a compromise propagates
- memory-poisoning — T1, where a compromise persists
- agentic-mitigation-playbooks — Playbook 3 in full
- AI supply chain — the vault’s primary treatment
- AI assistant instructions — prompt files as an attack surface
- ATLAS case studies —
AML.CS0049, poisoned skill supply chain compromise