Attackers who compromise public package registries (npm, PyPI, LangChain, LlamaIndex) or push malicious packages to open-source ecosystems. They know that AI coding agents automatically install dependencies — and that agents are far less likely than humans to notice unusual behavior in a package that passes automated scans.

Their goal: get into every developer's machine simultaneously, by compromising the package that thousands of agents will install on their behalf.

Attackers who publish fake MCP servers to npm or other registries, mimicking the names, APIs, and descriptions of legitimate services. The first documented in-the-wild malicious MCP server (impersonating Postmark) was found on npm — it had the right name, right API signatures, and right documentation. It also secretly BCC'd every email to the attacker.

As the MCP ecosystem grows, this attack surface grows with it. Every new legitimate MCP server creates an opportunity for a convincing impersonator.

Attackers who compromise the remote sources from which agents pull prompt templates, system instructions, or orchestration scripts. If an agent loads its system prompt from an external URL at startup, anyone who can modify that URL's content can reprogram the agent's behavior — without touching the agent's code or deployment.

Attackers who seed a shared knowledge index or RAG data source with crafted entries. The agent's retrieval system surfaces these entries as authoritative context. Over time, the agent's outputs shift in the attacker's desired direction — without any single obviously malicious action.

This is a slow, hard-to-detect attack. By the time the bias is noticed, hundreds of responses may have been affected.