Securing Agentic Development: Context Supply Chain Risks
Agentic AI introduces novel security vectors, including prompt injection and context supply chain attacks. This analysis outlines the 'Lethal Trifecta' of agent vulnerabilities and provides a framework for implementing least-privilege controls, context manifests, and human-in-the-loop governance to mitigate risk in AI-native engineering teams.
The Emerging Security Landscape in Agentic AI
The integration of Large Language Models (LLMs) and autonomous agents into software development introduces a fundamentally new attack surface. Traditional security models, designed for human-written code and static dependencies, are insufficient to address the dynamic, text-based nature of agentic workflows. The core risk lies in the "Lethal Trifecta": agents typically possess access to privileged private data, exposure to untrusted external content, and the ability to communicate externally. This combination creates a vector for prompt injection, where malicious instructions embedded in documentation or dependencies can manipulate agent behavior.
Context as a Supply Chain Vector
A critical shift is the recognition that text itself is now executable. Markdown files and skill definitions are no longer inert documentation but active instructions that can encode malicious intent. This necessitates a new approach to supply chain security, extending beyond traditional Software Bill of Materials (SBOM) to a Context Bill of Materials (CBOM). Organizations must track the provenance, versioning, and security posture of all context injected into agent environments. Without this visibility, teams are vulnerable to "slop squatting," where malicious packages are uploaded with names likely to be hallucinated or selected by LLMs, bypassing traditional social proof checks.
Strategic Governance and Least Privilege
Effective mitigation requires a shift from perimeter-based security to least-privilege architecture. Agents should be treated as untrusted contractors with limited, scoped access. This involves sandboxing execution environments, using short-lived credentials instead of static secrets, and implementing network egress controls. Furthermore, human oversight must be strategically allocated. While agents can autonomously handle reversible, low-risk tasks, irreversible actions such as production deployments require mandatory human approval gates. This hybrid model balances velocity with security, ensuring that the speed of agentic development does not outpace the organization's ability to audit and verify outcomes.
Conclusion
As AI-native development scales, security must evolve from a compliance checkbox to a core architectural principle. By treating context as code, enforcing strict provenance tracking, and implementing granular permission controls, engineering leaders can harness the productivity of agents without exposing their organizations to novel, high-impact security risks.
Key insights
-
The combination of private data access, untrusted content exposure, and external communication capabilities creates a high-risk environment for prompt injection attacks in agentic systems.
Impact: Organizations failing to isolate these three elements face significant risk of data exfiltration and system compromise through manipulated agent behavior.
-
Natural language text, such as markdown files and skill definitions, now carries executable intent, rendering traditional static analysis tools ineffective for detecting semantic vulnerabilities.
Impact: Security teams must adopt LLM-based content scanning to identify malicious instructions embedded in context files, a capability currently absent in most DevSecOps pipelines.
-
The lack of provenance tracking for agent context creates a new supply chain risk, where unverified skills from random repositories can introduce malicious code or data leaks.
Impact: Implementing a Context Bill of Materials (CBOM) is essential for auditing agent behavior and ensuring that only trusted, scanned context is used in production environments.
-
Agents often lack the social proof heuristics humans use to evaluate open-source packages, making them susceptible to 'slop squatting' attacks involving hallucinated or maliciously named libraries.
Impact: Engineering teams must enforce strict package verification and allow-listing to prevent agents from installing compromised dependencies that bypass traditional reputation checks.
-
Human oversight is a bottleneck in agentic workflows, requiring a risk-based approach where autonomous execution is limited to reversible tasks, while irreversible actions require human approval.
Impact: Strategic allocation of human review to high-risk areas, supported by automated testing and AI-assisted code reviews, optimizes both security and development velocity.
Action items
-
Implement a Context Bill of Materials (CBOM) to track, version, and verify the provenance of all skills and context files used by agents in the development environment.
Impact: Provides full auditability of agent inputs, enabling rapid identification and remediation of malicious or compromised context sources.
-
Deploy LLM-based content scanning for all markdown and skill files to detect semantic vulnerabilities and malicious instructions before they are processed by agents.
Impact: Mitigates the risk of prompt injection attacks by identifying executable intent in text files that static analysis tools would miss.
-
Refactor secret management to use short-lived, just-in-time credentials and sandbox agent execution environments to limit blast radius and prevent data exfiltration.
Impact: Reduces the impact of compromised agents by ensuring that stolen credentials expire quickly and that agents cannot access sensitive system resources.
-
Establish a risk-based approval framework where agents can autonomously execute reversible, low-risk tasks but require human sign-off for irreversible, high-risk operations like production deployments.
Impact: Balances development speed with security by focusing human attention on critical decision points while automating routine, low-risk activities.
-
Enforce strict package verification and allow-listing for all dependencies installed by agents, including checks for social proof and provenance, to prevent 'slop squatting' attacks.
Impact: Prevents agents from installing malicious or hallucinated packages, securing the software supply chain against novel AI-specific dependency risks.
Quotes
“Most agents by default are going to have all of these three things, and that is where you're one prompt injection away from, let's say, a bad time.”
“A markdown file that you're giving to an agent could encode some vulnerability to instruct the agent to go and do something malicious or just unsafe.”
“I think it's really interesting how we're just installing context into our agents in the same way that you might just pull something in from a repo pre-NPM or various package manager days.”