High
Supply Chain
Plugin / Tool Supply-Chain Compromise
A malicious or compromised third-party plugin/tool the agent is allowed to call - the code behind the tool, not the prompt, is the attack surface.
Remote Code ExecutionPrivilege Escalation
LLM03ASI04T2AML.T0053
Tells spot it before you commit
- » The agent loads plugins/tools from third parties or unpinned/unsigned sources.
- » Tool code runs with the agent's privileges and network reach.
- » Updates to a tool are pulled automatically without review (auto-update / floating version).
Method
- Enumerate installed plugins/tools and their permissions and origins.
- Check for pinning/signing; look for over-broad scopes (filesystem, network, secrets).
- Model the blast radius - what does a malicious version of each tool reach?
Payloads templates - adapt to authorized scope
List every tool/plugin the agent can call, its source, version pin, and the
scopes it holds (fs, net, secrets). Flag any unpinned/unsigned tool with broad scope.
Why it works
A tool the agent trusts executes with the agent's authority. If its code is malicious or gets compromised/updated, it can run code, read secrets, and act on the network - entirely outside the prompt/guardrail layer.
Impact
Remote code execution, credential theft, and privilege escalation through a trusted dependency; a single poisoned tool affects every agent that loads it.
Defenses
- Pin and sign tools/plugins; review updates; disallow auto-update of executable tools.
- Least-privilege scopes per tool; sandbox tool execution; monitor tool egress.
- Vet third-party tools; maintain an allow-list and an SBOM for the agent stack.
Mappings
OWASP LLM
LLM03 - Supply Chain
OWASP ASI
ASI04 - Supply Chain Vulnerabilities
Agentic Threats
T2 - Tool Misuse
MITRE ATLAS
AML.T0053 - Compromise LLM Plugins