🤖 Models

Pre-trained model weights are increasingly distributed through registries like Hugging Face, and model hubs.

Attack vectors:

• Trojan weights — Backdoors embedded during fine-tuning
• Model swapping — Replacing legitimate models with malicious versions
• Data poisoning — Training data contamination affecting outputs

# Example: Verifying model integrity
from huggingface_hub import hf_hub_download
import hashlib

# Download with known hash verification
expected_hash = "sha256:abc123..."
path = hf_hub_download(
    repo_id="meta-llama/Llama-2-7b",
    filename="model.bin"
)

# Verify file integrity
with open(path, "rb") as f:
    actual_hash = hashlib.sha256(f.read()).hexdigest()

if actual_hash != expected_hash.replace("sha256:", ""):
    raise ValueError("Model integrity check failed!")

Defenses: Hash verification, signature validation, model provenance tracking, SBOM for model components.

📦 Packages

Python and Node.js packages are prime targets for supply-chain attacks.

Attack vectors:

• Dependency confusion — Attacker publishes internal package names to public registries
• Typosquatting — Publishing packages with names similar to popular ones
• Maintainer compromise — Taking over legitimate package accounts
• Malicious updates — Pushing backdoored versions of established packages

# Example: Secure dependency management
# requirements.txt with pinned versions
torch==2.4.0+cpu
transformers==4.44.0
sentence-transformers==3.1.0

# Verify against known good lock file
# pip install pip-audit && pip-audit
# Check for known CVEs

Defenses: Pin versions, use lock files, audit dependencies, verify package signatures, monitor for CVEs.

🔌 MCP Servers

MCP servers extend agent capabilities but can be compromised or malicious.

Attack vectors:

• Tool poisoning — Malicious tool descriptions injecting instructions
• Data exfiltration — Tool responses containing hidden exfiltration commands
• Privilege escalation — Tools requesting excessive permissions

Defenses:

• Tool allowlisting — Only approved MCP servers
• Read-only by default — Minimize write permissions
• Output validation — Scan tool responses for injection patterns
• Audit logging — Record all tool invocations

⚡ Skills and Plugins

Agent skills and plugins extend functionality but can introduce vulnerabilities.

Attack vectors:

• Malicious skill code — Backdoors in skill implementations
• Skill supply chain — Dependencies of skills introducing vulnerabilities
• Permission abuse — Skills requesting unnecessary access

Defenses:

• Code review before installation
• Sandboxed execution
• Permission scoping
• Regular security updates

📁 Repositories

AI coding agents interact directly with code repositories.

Attack vectors:

• Malicious comments — Injection via code comments
• Poisoned documentation — Instructions in README or docs
• Booby-trapped issues — Malicious GitHub Issues

Defenses:

• Branch protection rules
• Required code reviews
• Content sanitization
• Treat repository content as untrusted

🐳 Containers

Docker containers provide reproducible environments but can contain vulnerabilities.

Attack vectors:

• Vulnerable base images — Outdated system packages
• Image tampering — Modified images in registries
• Secret leakage — Credentials baked into images

Defenses:

• Image scanning (Trivy, Snyk)
• Digest pinning (not just tags)
• Minimal base images
• Multi-stage builds
• No secrets in images