Slide 8 of 28
Part 1 — What Is It?Slide 8
PART 1 WRAP-UP
Why Runtime Composition Changes Everything
The final concept that ties Part 1 together
Slide 8 · Why This Is Different
The feature that makes agentic systems useful is the same feature that makes supply chain attacks so dangerous
Runtime composition is the design choice behind the risk.
Runtime composition — the short version

An agentic system is designed to extend itself at runtime. It can discover new tools from a registry, load a plugin it's never seen before, call a sub-agent to handle a specialized task, pull fresh context from a knowledge base, or load a persona for a new use case — all while running, all without a human explicitly approving each addition.

This is the design that makes agents useful. A statically configured agent with fixed tools can only do what it was explicitly built for. A dynamically composing agent can handle tasks nobody anticipated at build time.

The tradeoff

Every time an agent loads a new component at runtime, it makes a trust decision. Is this tool, server, or plugin what it claims to be?

In traditional software, that decision is made by a human developer before shipping. In an agentic system, the decision is made automatically at runtime — often based on a text description alone. The agent cannot run a background check on every component it encounters.

An attacker who poisons any of those components — a registry, a tool descriptor, an MCP server, a prompt template — gets their malicious code loaded and trusted as if it were legitimate.

The key insight going into Part 2

The six vulnerability types in Part 2 are all expressions of the same underlying dynamic: an agent's ability to compose capabilities at runtime creates a live attack surface that traditional supply chain security was never designed to address. Each type is a different entry point for a poisoned component to reach a trusting agent.

← Back Part 2: The six vulnerability types →