SOK Agentic Supply Chain Runtime

Paper Summary | ICLR 2026 Workshop on AI for Mechanism Design | Generated by Hermes Agent

Executive Summary: This SoK systematizes security threats to LLM-based agentic systems arising from their dynamic runtime supply chain — the inference-time data and tool dependencies that agents acquire and resolve autonomously. The authors introduce the Man-in-the-Environment (MitE) adversary who exploits Prompt-Data Isomorphism to manipulate agents through retrieved data, and identify the Viral Agent Loop where agents become vectors for self-propagating generative worms that require no code vulnerabilities. They categorize threats into Data Supply Chain attacks (transient context injection vs persistent memory poisoning) and Tool Supply Chain attacks (discovery, implementation, and invocation phases), and argue for a Zero-Trust Runtime Architecture with cryptographic provenance and auditor-worker decoupling.

High-Level Overview

This paper addresses a fundamental security shift: traditional software supply chains resolve dependencies (libraries, binaries) statically at build time, but agentic systems assemble their execution context dynamically at runtime from untrusted, probabilistically selected sources — documents, APIs, tool registries, memories. This converts inference-time context from a passive input into an active component of the attack surface. The authors systematize 40+ prior works into a unified threat taxonomy mapped to the agentic runtime loop, revealing structural patterns that isolated defenses miss.

Problem Statement

While prior work has examined model-level vulnerabilities (training data poisoning, backdoors), security risks from the complex, cyclic runtime behavior of autonomous agents remain fragmented. Agentic systems are unique in that:

Prompt-Data Isomorphism: Retrieved passive data is upcast into active instructions during inference, blurring the line between data and control flow
Cyclic Execution: Agent outputs (emails, wiki edits, git pushes) re-enter the environment and become future inputs, enabling persistent and self-reinforcing failures
Stochastic Dependency Resolution: Tools and context are selected via semantic probability, not cryptographic identity

The core question: how do we taxonomize and defend against attacks that operate through semantic manipulation of inference rather than binary exploitation?

Core Threat Model: Man-in-the-Environment (MitE)

Aspect	Description
Adversary	Does NOT compromise model weights, system prompts, or hosting infrastructure
Attack Surface	Public data sources (wikis, forums, repos), tool registries, API descriptions
Mechanism	Pollutes the environment the agent trusts as its source of truth — the environment becomes a malicious upstream “vendor”
Effect	Dormant artifacts, voluntarily retrieved by the agent, hijack the reasoning loop

The canonical example: an Autonomous Travel Agent retrieves a blog claiming a hotel discount via an external API, then downloads and invokes a Python library suggested by the blog — each step introduces an unvetted runtime artifact.

Core Taxonomy

1. The Data Supply Chain

Within-Session Manipulation (transient, expires on session reset):

Indirect Prompt Injection — Payload embedded in third-party data (web pages, emails, images/sounds with adversarial perturbations). Agents with browser/email tools fetch untrusted content and prepend it to the query, achieving up to 98% attack success rate.
In-Context Learning Exploitation (Many-Shot Jailbreaking) — Flooding short-term memory with 256+ fabricated dialogue turns of the agent helpfully answering malicious queries. ASR follows a power-law growth as shot count increases, rendering alignment filters obsolete within a single session.

Across-Session Manipulation (persistent, stored in external memory):

Knowledge Base Contamination (RAG Poisoning) — Adversarial strings hijack vector space retrieval. Poisoning only 0.1% of an external corpus achieves 70%+ ASR for targeted queries (PoisonedRAG). AGENTPOISON uses constrained optimization for stealthy backdoors with 80%+ ASR.
Long-Term Memory Poisoning — Agents that write their own episodic experiences create a feedback loop. The MINJA framework achieves 76.8% ASR injecting malicious records into memory banks via query-only interaction.

2. The Tool Supply Chain

Tools are modeled as operational capabilities with four invariants: identity integrity, semantic binding, authority bounding, and implementation integrity.

Phase I: Discovery (Intent → Tool_ID)

Hallucination Squatting — Agents hallucinate plausible but non-existent tool identifiers. Adversaries preemptively register these “ghost” identifiers as malicious packages. Hallucinated names are predictable and recur across models.
Semantic Masquerading — Adversarially crafted tool metadata maximizes similarity with common queries, displacing legitimate tools in retrieval rankings.

Phase II: Implementation (Load → Runtime Code)

Hidden Backdoors — Tools that implement advertised functionality normally but embed trigger-based malicious logic, maintaining high apparent utility.
Transitive Dependency Exploitation — Tool setup triggers installation of auxiliary packages; package managers permit arbitrary code execution during installation. A benign tool may execute malicious transitive dependencies before the intended tool is ever invoked.

Phase III: Invocation (Execution Boundary)

Over-Privileged Invocation — Agents provisioned with broad permissions; adversaries induce “confused deputy” failures where low-privilege components trigger high-privilege tool execution via natural-language channels.
Argument Injection / Logical Boundary Breaches — Analogous to SSRF in web applications. Injected prompts silently generate malicious parameters for connected tools (Cross-Plugin Request Forgery).

3. The Viral Agent Loop

The defining agentic risk: when data ingestion and tool execution are coupled, agent outputs can re-enter the environment as future inputs, closing the loop.

Generative Worms (Morris II) — Prompt-based self-replication across GenAI email agents via authorized communication tools. Propagation via semantic compliance, not code exploits.
Persistent Ecosystem Contamination — Agents writing to shared wikis/repos upload poisoned outputs that are later re-ingested through retrieval.
Topological Shift — Supply chain becomes a cycle instead of a DAG, collapsing the supplier/consumer boundary.

Systematization of Existing Defenses

Layer	Attack Vector	Existing Defenses	Limitation
Perception	Prompt Injection	Instruction Hierarchy, Intent Verification	Bypassed by semantic payloads (Prompt-Data Isomorphism)
Memory	RAG & State Poisoning	Statistical Filtering, Audited Writes	Falls short against structural graph poisoning
Phase I	Hallucination Squatting	Static Registry Allowlists	Blind to agent’s semantic intent
Phase II	Dependency Pollution	Signed SBOMs, SLSA	Same — a verified tool used for malicious action
Phase III	Privilege Escalation	Scoped Permissions (MCP), Multi-stage Arbiters	“AI-guarding-AI” inherits prompt injection vulnerability

Proposed: Zero-Trust Agentic Runtime Architecture

Three core imperatives:

Deterministic Capability Binding — Cryptographically Bound Registries verify tool provider identity. Tool execution bounded by cryptographic provenance, not semantic likelihood. Eliminates the “Hallucination Gap.”
Neuro-Symbolic Information Flow Control — Runtime Taint Analysis tags untrusted inputs as TAINTED and tracks taint through non-deterministic LLM reasoning chains. Blocked at write-privileged sinks pending sanitization. Underpinned by Cryptographic Provenance Ledgers.
Auditor-Worker Architecture (Semantic Firewalls) — Structurally decouples execution from oversight. An isolated Supervisor Model acts as an inline Semantic Firewall via speculative execution — analyzing proposed tool calls, parameters, and prompt lineage before committing side effects. Bridges the gap between benign user intent and hazardous execution.

Key Findings and Insights

Context is Code: The fundamental insight — in agentic systems, inference-time context functions as functional control flow, not passive data. This is the root cause of all identified attack vectors.
Cyclic > Acyclic: The Viral Agent Loop invalidates defenses that assume a DAG supply chain topology. Agents become both consumers and suppliers.
Structural Separation > Semantic Filters: Existing defense paradigms inherit assumptions from static supply chains and apply localized patches. True security requires architecturally separating oversight from execution (Auditor-Worker).
No Code Exploit Required: Generative worms propagate through instruction-following under legitimate tool permissions — patching software vulnerabilities is insufficient.

Limitations

Taxonomy is architecture-informed but not empirically validated against a unified benchmark
Existing defenses are analyzed theoretically rather than through comparative experimental evaluation
Zero-Trust Runtime Architecture is proposed as a framework direction rather than an implemented system
Practical feasibility of cryptographic taint tracking through neural network abstractions remains an open problem

How It Relates to Prior Work

This SoK bridges two largely separate literatures: (1) LLM-specific security (prompt injection, jailbreaking) and (2) traditional software supply chain security (SBOMs, SLSA). It reframes both through the lens of inference-time dependency resolution, revealing that standard defenses fail because they assume acyclic, enumerable, static dependencies — assumptions violated by autonomous agents operating in open environments.

TL;DR

LLM-based agents face a fundamentally new security model where context is control flow and data sources are implicit dependencies. The authors taxonomize attacks into Data Supply Chain (transient/permanent manipulation) and Tool Supply Chain (three-phase capability hijacking), identify the Viral Agent Loop as a unique agentic threat, and call for Zero-Trust architectures with cryptographic provenance binding and auditor-worker separation. This framework has direct implications for the security of autonomous coding agents, RAG systems, multi-agent deployments, and any system where LLMs dynamically retrieve and act on untrusted data.