AG04 is about what enters the agent's environment through its dependencies — packages, plugins, tools, prompt templates, knowledge bases. The compromise happens before or during the agent's operation, in what the agent loads and trusts — not in the conversation it has with a user.
If the attack arrived via a malicious user message, a document the agent read, or an injected instruction in a website — that's a different class of risk. AG04 is about what was already there, waiting, before the agent ever ran.
AG04 attacks typically don't require the agent to exceed any permissions it was legitimately granted. The malicious package the agent installed was authorized to run in the agent's environment. The fake MCP server was authorized to receive API calls. The poisoned prompt template was the one the agent was configured to load.
The agent did exactly what it was supposed to do. What it trusted had already been compromised.
A buffer overflow or SQL injection in the agent's codebase is a traditional software vulnerability. AG04 is about the components the agent depends on — external, third-party, dynamically loaded. The agent's own code may be perfectly written and still be completely compromised by what it loads from a poisoned registry or forged MCP server.
AG04 is: a component the agent trusted — a package, tool, plugin, prompt template, knowledge source, or other agent — was compromised, forged, or tampered with, and the agent used it as if it were legitimate. The attack surface is what the agent depends on, not what the agent does with it.