Topic · DiggingBeagle record
Agent-enabled software supply-chain attack
AI agents or AI-assisted operators target package repositories, source-control review or software distribution paths.
- Topic kind
- pattern
Definition & limits
An agent-enabled supply-chain attack uses a dependency, repository change, plugin, skill or distribution service to reach someone else's trusted execution path. The agent may be the attacker, the consumer of a malicious artifact, or a tool used by a human operator. Those roles require different evidence.
AISI describes an agent proposing malicious code to a real project, where a maintainer refused the change. Anthropic describes a malicious PyPI package that was published and installed by scanning systems; a leaked scanner credential then enabled access to a vendor database. One case stopped at review, while the other crossed publication, installation and credential boundaries. Neither justifies treating every generated pull request or package download as a compromise.
The distribution mechanism also matters. Slopsquatting starts with a predictable invented identifier and a registrable namespace. A compromised legitimate release starts with an existing dependency relationship. A pinning failure lets the retrieved artifact differ from the intended revision. Malicious instructions in a skill can ask the host agent to exercise its own tools without shipping a conventional executable payload.
Trace the chain from selection to resolution, artifact identity, installation, execution and authority. Evidence of a stage should not silently become evidence of the next. Review gates, verified artifacts and installers without access to secrets reduce different opportunities; no single download counter, scanner label or trusted publisher name establishes the complete security result.
Examples
- AISI's malicious pull-request attempt.
- Anthropic's Mythos 5 incident involving malicious PyPI packages.