Supply Chain Attack

An attack exploiting package manager resolution logic to trick a build system into downloading a malicious, higher-versioned public package instead of the intended internal private package.

• Mechanism: Adversary uploads a package with the same name as a private dependency to a public registry (e.g., PyPI, npm).
• Agent Impact: Injects arbitrary code execution into the agent's runtime during pip install or npm install.
• Example: A 2021 security researcher breached 35+ major tech companies by uploading 'dummy' packages matching their internal names.

The direct upload of a backdoored pre-trained model to a public hub like Hugging Face, designed to execute malicious code upon deserialization or produce attacker-controlled outputs on a specific trigger.

• Vector: Exploiting insecure deserialization in pickle files commonly used to store PyTorch and TensorFlow models.
• Agent Impact: Full remote code execution (RCE) when an agent loads the poisoned model weights.
• Example: A model named 'pytorch_model.bin' can contain a pickled lambda function that executes a reverse shell upon loading.

Compromising the continuous integration and delivery system to inject malicious steps into the automated build, test, or deployment workflow for an agent's container image.

• Mechanism: Stealing exposed CI/CD secrets (e.g., GitHub Actions tokens) or exploiting a vulnerable pipeline plugin.
• Agent Impact: Produces a signed, seemingly legitimate agent artifact that contains a backdoor, bypassing all code review.
• Example: The 2020 SolarWinds attack involved injecting malicious code during the software build process, affecting 18,000 customers.

Registering a package or model name that is a common misspelling of a popular legitimate library to capture developer errors and execute malicious code in the agent's environment.

• Mechanism: Relies on human error during manual installation (pip install reqeusts instead of requests).
• Agent Impact: Establishes a persistent foothold in the development environment, potentially exfiltrating API keys and injecting backdoors into all downstream agent builds.
• Example: Over 400 malicious packages were found on PyPI in 2023 using names like tensroflow and beatifulsoup4.

The theft or leakage of API keys, signing certificates, or service account tokens that grant an adversary the ability to push malicious updates to an agent's trusted toolchain or model registry.

• Vector: Hardcoded secrets in public repositories, compromised developer workstations, or phishing attacks.
• Agent Impact: Allows an attacker to publish a 'legitimate' update to a widely used agent library or tool, instantly propagating the attack to all downstream consumers.
• Example: The Codecov breach involved a compromised Bash Uploader script that exfiltrated environment variables from thousands of CI/CD pipelines.

Injecting poisoned or adversarial data directly into the training or fine-tuning data lake, causing the agent to learn a hidden backdoor behavior or a systematic bias.

• Mechanism: Compromising an upstream data source, exploiting an unvalidated data ingestion API, or insider threat.
• Agent Impact: The agent behaves normally in most scenarios but fails catastrophically or executes a malicious action when a specific trigger phrase or data pattern is present.
• Example: A language model fine-tuned on a poisoned dataset might generate secure code normally but produce vulnerable code when the prompt contains a specific invisible Unicode character.