AI · 96 days ago

One Poisoned Dependency Can Backdoor Agent Frameworks

Agentic AI risk has moved past theory. A single hostile dependency can now become a broad foothold inside the tool layer, because many agents treat outside text and package updates as trusted inputs to action, not just data to display.

OWASP’s 2026 agentic AI report now ties the category to real CVEs, vendor advisories, and breach reports. Its most concrete example is the March 2026 LiteLLM PyPI compromise, which sat on PyPI for three hours, saw nearly 47,000 downloads, and spread a malicious backdoor package through CrewAI, DSPy, Microsoft GraphRAG, and other frameworks that pull it in.

The practical shift is that shared agent gateways are now part of the threat surface. If one of those dependencies is poisoned, the compromise can fan out across multiple autonomous tools at once and survive normal app-level triage unless the inherited trust chain is checked directly.

CVE-2025-6514

NVD KEV

CVSS 9.6 CRITICAL: mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the… EPSS 78% (100th percentile).

CVE-2025-59532

NVD KEV

EPSS 0.9% (56th percentile).

CVE-2026-22708

NVD KEV

CVSS 9.8 CRITICAL: cursor is a code editor built for programming with AI. EPSS 0.8% (54th percentile).

Timeline

Jun 11 Reported by Help Net Security
Jun 8 Reported by Infosecurity Magazine

Sources

2 sources covering this story

Help Net Security Jun 11
Prompt injection still drives most agentic AI security failures in production - Help Net Security
OWASP's 2026 report puts prompt injection security at the center of agentic AI risk, citing CVEs, supply chain breaches, and tighter rules.
Infosecurity Magazine Jun 8
Prompt Injection Remains Unsolved, OWASP Researcher Warns
At Infosecurity Europe 2026, OWASP’s Ariel Fogel warned that prompt injection remains an “unresolved problem” within generative AI architecture

Entities

CVE-2025-6514
CVE-2026-22708
CVE-2025-59532

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-06-12

Editions

AI · 96 days agoOne Poisoned Dependency Can Backdoor Agent FrameworksAgentic AI risk has moved past theory. A single hostile dependency can now become a broad foothold inside the tool layer, because many agents treat outside text and package updates as trusted inputs to action, not just data to display.OWASP’s 2026 agentic AI report now ties the category to real CVEs, vendor advisories, and breach reports. Its most concrete example is the March 2026 LiteLLM PyPI compromise, which sat on PyPI for three hours, saw nearly 47,000 downloads, and spread a malicious backdoor package through CrewAI, DSPy, Microsoft GraphRAG, and other frameworks that pull it in.The practical shift is that shared agent gateways are now part of the threat surface. If one of those dependencies is poisoned, the compromise can fan out across multiple autonomous tools at once and survive normal app-level triage unless the inherited trust chain is checked directly.

CVE-2025-6514

NVD KEV

CVSS 9.6 CRITICAL: mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the… EPSS 78% (100th percentile).