An agentic system is designed to extend itself at runtime. It can discover new tools from a registry, load a plugin it's never seen before, call a sub-agent to handle a specialized task, pull fresh context from a knowledge base, or load a persona for a new use case — all while running, all without a human explicitly approving each addition.
This is the design that makes agents useful. A statically configured agent with fixed tools can only do what it was explicitly built for. A dynamically composing agent can handle tasks nobody anticipated at build time.
Every time an agent loads a new component at runtime, it makes a trust decision. Is this tool, server, or plugin what it claims to be?
In traditional software, that decision is made by a human developer before shipping. In an agentic system, the decision is made automatically at runtime — often based on a text description alone. The agent cannot run a background check on every component it encounters.
An attacker who poisons any of those components — a registry, a tool descriptor, an MCP server, a prompt template — gets their malicious code loaded and trusted as if it were legitimate.
The six vulnerability types in Part 2 are all expressions of the same underlying dynamic: an agent's ability to compose capabilities at runtime creates a live attack surface that traditional supply chain security was never designed to address. Each type is a different entry point for a poisoned component to reach a trusting agent.