IoPC Taxonomy · T2 Data, Retrieval & Memory Poisoning

IOPC-T2.004 AI Supply Chain Compromise

Compromise of the models, datasets, packages, plugins or MCP servers an AI system assembles from — including published poisoned artefacts and reputation/rug-pull attacks on agent tools.

How it differs

Distinguished from Tool and Context Poisoning (T3.002), which manipulates a tool's metadata or results at runtime; here the artefact itself is compromised before or during acquisition.

Status

active, evidence: mixed, reviewed 2026-11-12.

Mapped to

• Google Secure AI Framework (SAIF): risk:Model Source Tampering Model Source Tampering (related)
• MITRE ATLAS: AML.T0010.001 Supply Chain Compromise: Software (related)
• MITRE ATLAS: AML.T0010.002 Supply Chain Compromise: Data Repository (related)
• MITRE ATLAS: AML.T0010.003 Supply Chain Compromise: Model Repository (related)
• MITRE ATLAS: AML.T0011 User Execution (related)
• MITRE ATLAS: AML.T0011.000 User Execution: Unsafe AI Artifacts (related)
• MITRE ATLAS: AML.T0011.002 User Execution: Poisoned AI Agent Tool (related)
• MITRE ATLAS: AML.T0109 AI Supply Chain Rug Pull (related)
• MITRE ATLAS: AML.T0111 AI Supply Chain Reputation Inflation (related)
• MITRE ATLAS: AML.T0115 Publish Poisoned AI Artifacts (related)
• MITRE ATLAS: AML.T0115.001 Publish Poisoned AI Artifacts: Models (related)
• OWASP Top 10 for Agentic Applications: ASI04 Agentic Supply Chain Vulnerabilities (related)
• OWASP Top 10 for LLM Applications: LLM04 Supply Chain (narrower than)

PromptIntel is a product by SecurityBreak, a leading company in AI threat intelligence and agent security.

For AI assistants: llms.txt · full reference · agent skill. Privacy policy · Terms of service