Model supply chain, plugin, and dependency attacks
Newest first · 5 reviewed on this page
Search insteadVarun Pratap Bhardwaj
The rapid proliferation of agentic AI skill ecosystems -- exemplified by OpenClaw (228,000 GitHub stars) and Anthropic Agent Skills (75,600 stars) -- has introduced a critical supply chain attack surface. The ClawHavoc campaign (January-February 2026) infiltrated over 1,200…
Hanzhi Liu, Chaofan Shou, Hongbo Wen +3
Large language model (LLM) agents increasingly rely on third-party API routers to dispatch tool-calling requests across multiple upstream providers. These routers operate as application-layer proxies with full plaintext access to every in-flight JSON payload, yet no provider…
Ronghao Ni, Mihai Christodorescu, Limin Jia
The rapidly evolving Node$.$js ecosystem currently includes millions of packages and is a critical part of modern software supply chains, making vulnerability detection of Node$.$js packages increasingly important. However, traditional program analysis struggles in this setting…
Sujan Ghimire, Parsa Mirfasihi, Muhtasim Alam Chowdhury +6
The globalization of integrated circuit (IC) design and manufacturing has increased the exposure of hardware intellectual property (IP) to untrusted stages of the supply chain, raising concerns about reverse engineering, piracy, tampering, and overbuilding. Hardware netlist…
Jafar Isbarov, Umid Suleymanov, Ilia Shumailov +1
AI-powered agents are increasingly embedded in continuous integration and continuous delivery/deployment (CI/CD) pipelines to autonomously review pull requests (PRs), triage issues, and maintain codebases. These agents ingest untrusted content while operating with elevated…
Wenbo Guo, Wei Zeng, Chengwei Liu +5
AI coding agents such as Claude Code and Gemini CLI increasingly extend themselves with third-party skills: markdown packages bundling natural-language instructions, executable scripts, and tool permissions. Because a skill is at once code and agent-facing instruction, it…
Kiarash Ahi, Vaibhav Agrawal, Saeed Valizadeh
As AI shifts from human-in-the-loop interfaces to autonomous multi-agent systems capable of real-time code execution and tool integration through protocols like the Model Context Protocol (MCP), traditional SAST, DAST, and legacy AI safety methods fail to detect modern…
Maria Rosaria Briglia, Igor Maljkovic, Antonio Emanuele Cinà +3
Vision--Language Models (VLMs) are increasingly deployed through a model supply chain in which pretrained checkpoints, architecture definitions, text encoders, and exported computation graphs are distributed by third parties and reused across downstream services. This reuse…
Jiahao Shi, Edward Tsien, Yifeng Di +10
The software supply chain has become an increasingly exposed attack surface because of its reliance on intricate yet fragile dependencies. Existing defenses such as GitHub Dependabot often raise many false alerts because their coarse-grained matching cannot determine whether a…
Karan Parekh, Sanjana Pendyala Ravinder, Sana Mhapsekar +1
Large language models are increasingly proposed as automated auditors of document quality, yet their reliability as detectors of planted errors is poorly characterised. We construct a contaminated corpus of 150 academic papers spanning supply chain management and medical…
Hao Sui, Simeng Qin, Jie Liao +3
Agent skills, bundles of instructions and resources that an LLM agent loads on demand, form an emerging supply chain where a single poisoned skill can persistently compromise every agent that installs it. However, existing skill attacks either fire on every request or rely on…
Jose Luna, Lili Quan, Ivan Tan +4
The rapid advancement and deployment of large language models (LLMs) have led to increasingly complex LLM based systems that operate as multi stage pipelines rather than isolated model instances. These systems span dataset construction, model preparation, system integration, and…
Toqeer Ali Syed, M. R. Belgaum, Salman Jan +2
Software supply chain attacks increasingly target trusted development and delivery processes, making conventional post-build integrity mechanisms insufficient. Existing frameworks like SLSA, SBOM, and in-toto mainly provide provenance and traceability but cannot actively…
Nicholas Carlini, Matthew Jagielski, Christopher A. Choquette-Choo +6
Demonstrates practical attacks to poison web-scale datasets like LAION by purchasing expired domains, affecting 0.01% of a dataset for under $60.
Manish Bhatt, Sahana Chennabasappa, Cyrus Nikolaidis +2
Introduces CyberSecEval, a benchmark for evaluating the cybersecurity risks of LLM code generation, including insecure code suggestions.
Jiaqi Xue, Mengxin Zheng, Ting Hua +4
Proposes TrojLLM, a black-box attack that generates universal trojan prompts to compromise LLMs without access to model internals.
Sagiv Antebi, Noam Azulay, Edan Habler +3
Analyzes security risks of custom GPTs in the OpenAI GPT Store including prompt leakage, data exfiltration, and malicious GPTs.
Ayush RoyChowdhury, Mulong Luo, Prateek Sahu +2
Introduces confused deputy attacks against RAG-based code assistants like GitHub Copilot, where poisoned code repositories manipulate assistant outputs.