Supply-chain compromise
A package, plug-in, extension or model the agent relies on is malicious.
NIST AI 600-1 · Value Chain and Component IntegrationOWASP LLM03OWASP Agentic ASI04
9incidents (primary) · 0 more as secondary
1read for controls · 8 not yet
5fixes reported
0repeats after a fix
Incidents per quarter
2025-Q3: 2 · 2025-Q4: 0 · 2026-Q1: 0 · 2026-Q2: 1 · 2026-Q3: 2 · 2026-Q4: 4
Developers
Anthropic · 1
OpenAI · 1
Amazon Web Services · 1
Where the chain broke
| Layer | Held | Did not hold | Not mentioned | Attacker's own | Not read yet |
|---|---|---|---|---|---|
| L1 Model Model provider | 1 | – | – | – | 8 |
| L2 Harness Agent framework vendor | – | – | 1 | – | 8 |
| L3 Application Deployer | – | 1 | – | – | 8 |
| L4 Infrastructure / target Organisation hit | – | – | 1 | – | 8 |
Controls for this risk, by layer
HeldFailedGot aroundMissing
| Control | Held | Failed | Got around | Missing | Not mentioned | Did not hold, last 6 quarters | Added in fixes | Most common reason |
|---|---|---|---|---|---|---|---|---|
| Sandboxed code execution L2 Harness | – | – | – | – | 1 | – | ||
| Least-privilege access for the agent L3 Application | – | – | – | 1 | – | – | Access broader than the task | |
| Signed and verified components L3 Application | – | – | – | – | 1 | 2 | ||
| AI bill of materials L3 Application | – | – | – | – | 1 | – | ||
| Vetting of plug-ins, skills and dependencies L3 Application | – | – | – | – | 1 | 1 | ||
| Vulnerability scanning of AI components L3 Application | – | – | – | – | 1 | – | ||
| Model provenance checks L3 Application | – | – | – | – | 1 | – | ||
| Secrets scanning L4 Infrastructure / target | – | – | – | – | 1 | – |
8 of 8 controls for this risk not yet seen holding.
Fixes reported and what followed
| Incident | Fix adds | After |
|---|---|---|
| LR-2026-0281 2026-10-30 · Anthropic Fix reported | Not tied to a control | No repeat on record |
| LR-2026-0257 2026-10-28 · Fix reported | Not tied to a control | – |
| LR-2026-0256 2026-10-23 · Fix reported | Not tied to a control | – |
| LR-2026-0250 2026-09-28 · Advice in source, not a fix by the party | Signed and verified components | – |
| LR-2026-0087 2026-07-11 · Fix reported | Vetting of plug-ins, skills and dependencies | – |
| LR-2025-0041 2025-08-26 · Fix reported | Short-lived, scoped credentialsSigned and verified components | – |
Incidents
HeldFailedGot aroundMissingNot mentionedNot read yetAttacker's ownOrder: model · harness · application · target