Six vulnerability types — six different points where a poisoned component enters the agent's trust boundary
Each type targets a different kind of component. Together they cover the full surface of an agentic supply chain.
Type 1
Poisoned prompt templates and tool descriptors
Malicious instructions injected into the text the agent reads to understand what a tool does or how to behave
Type 2
Impersonation and typosquatting
Fake tools, plugins, or MCP servers published under names nearly identical to legitimate ones, exploiting trust in familiar names
Type 3
Vulnerable third-party agents (A2A)
A sub-agent in a pipeline is compromised or contains vulnerabilities — its outputs propagate untrusted data to orchestrating agents
Type 4
Compromised MCP or registry servers
A shared infrastructure component — an MCP server or package registry — is hijacked, turning every agent that relies on it into a victim
Type 5
Poisoned knowledge plugins (RAG)
Malicious entries seeded into a knowledge index or RAG data source gradually bias the agent's context and outputs
Type 6
Agent-in-the-middle via agent cards
A forged or tampered agent card redirects agent-to-agent communication through an attacker-controlled intermediary