Five questions on AG04 — Agentic Supply Chain Vulnerabilities
Question 1 of 5
A developer's AI coding agent automatically installs a package from npm as part of a dependency update. The package passes signature verification and shows no known CVEs. It then silently reads SSH keys from the developer's home directory and sends them to an attacker. Which best describes what went wrong?
Question 2 of 5
A fake MCP server was published on npm with a name one character different from a popular legitimate server. It had matching API signatures and documentation. An AI assistant selected and installed it, not the legitimate one, because it appeared first in a registry search. What category of attack is this?
Question 3 of 5
An attacker creates a GitHub issue containing hidden text — invisible to humans but readable by an LLM — instructing an AI assistant to read and exfiltrate a developer's private repository. The assistant fetches the issue as part of its normal GitHub workflow and follows the hidden instructions. Why is this an agentic supply chain attack rather than a simple user-sent prompt injection?
Question 4 of 5
An organization's agent fleet uses a shared prompt hub to load system instructions. An attacker compromises the hub. Which mitigation is specifically designed to limit the impact of exactly this kind of shared infrastructure compromise — by enabling the organization to cut off the compromised component immediately without taking down all agents?
Question 5 of 5
Why do agentic supply chains create a fundamentally larger attack surface than traditional software supply chains — even when the same packages and registries are involved?