One Poisoned Dependency Can Backdoor Agent Frameworks
Agentic AI risk has moved past theory. A single hostile dependency can now become a broad foothold inside the tool layer, because many agents treat outside text and package updates as trusted inputs to action, not just data to display.
OWASP’s 2026 agentic AI report now ties the category to real CVEs, vendor advisories, and breach reports. Its most concrete example is the March 2026 LiteLLM PyPI compromise, which sat on PyPI for three hours, saw nearly 47,000 downloads, and spread a malicious backdoor package through CrewAI, DSPy, Microsoft GraphRAG, and other frameworks that pull it in.
The practical shift is that shared agent gateways are now part of the threat surface. If one of those dependencies is poisoned, the compromise can fan out across multiple autonomous tools at once and survive normal app-level triage unless the inherited trust chain is checked directly.