Slide 7 of 28
Part 1 — What Is It?Slide 7
Slide 7 · What This Is — And What It Isn't
Three things people confuse with AG04. None of them are the same risk.
Getting the boundary right matters — because supply chain defenses are fundamentally different from runtime defenses.
It's not about an attacker injecting bad instructions into a live conversation

AG04 is about what enters the agent's environment through its dependencies — packages, plugins, tools, prompt templates, knowledge bases. The compromise happens before or during the agent's operation, in what the agent loads and trusts — not in the conversation it has with a user.

If the attack arrived via a malicious user message, a document the agent read, or an injected instruction in a website — that's a different class of risk. AG04 is about what was already there, waiting, before the agent ever ran.

It's not about an agent exceeding its own permissions

AG04 attacks typically don't require the agent to exceed any permissions it was legitimately granted. The malicious package the agent installed was authorized to run in the agent's environment. The fake MCP server was authorized to receive API calls. The poisoned prompt template was the one the agent was configured to load.

The agent did exactly what it was supposed to do. What it trusted had already been compromised.

It's not about a vulnerability in the agent's own code

A buffer overflow or SQL injection in the agent's codebase is a traditional software vulnerability. AG04 is about the components the agent depends on — external, third-party, dynamically loaded. The agent's own code may be perfectly written and still be completely compromised by what it loads from a poisoned registry or forged MCP server.

The one-sentence boundary

AG04 is: a component the agent trusted — a package, tool, plugin, prompt template, knowledge source, or other agent — was compromised, forged, or tampered with, and the agent used it as if it were legitimate. The attack surface is what the agent depends on, not what the agent does with it.

← Back Why does runtime composition make this so much worse? →