Supply Chain
Software Supply Chain Attack
Also: supply chain attack
An attack that compromises code, tools or services you depend on, so the malicious change reaches you through a trusted channel.
In more detail
Instead of attacking you directly, the attacker poisons a package, a build step, an update server or a plugin that you install willingly. AI tooling adds new links to the chain: agent skills, MCP servers, model files and the packages an agent chooses to install on its own. Controls include pinning versions, verifying provenance, reviewing new dependencies and watching what installs run.