Abstract
Agentic systems built on large language models (LLMs) extend beyond text generation to autonomously retrieve information and invoke tools. This runtime execution model shifts the attack surface from build-time artifacts to inference-time dependencies, exposing agents to manipulation through untrusted data and probabilistic capability resolution. While prior work has focused on model-level vulnerabilities, security risks emerging from cyclic and interdependent runtime behavior remain fragmented. We systematize these risks within a unified runtime framework, categorizing threats into data supply chain attacks (transient context injection and persistent memory poisoning) and tool supply chain attacks (discovery, implementation, and invocation). We further identify the Viral Agent Loop, in which agents act as vectors for self-propagating generative worms without exploiting code-level flaws. Finally, we advocate a Zero-Trust Runtime Architecture that treats context as untrusted control flow and constrains tool execution through cryptographic provenance rather than semantic inference.
Abstract (translated)
基于大型语言模型（LLM）的代理系统不仅限于文本生成，还能自主检索信息并调用工具。这种运行时执行模式将攻击面从构建时的工件转移到了推理时的依赖关系上，使代理更容易受到通过不可信数据和概率能力解析进行操纵的影响。尽管之前的工作主要集中在模型层面的安全漏洞上，但源自循环及相互依存的运行行为所出现的安全风险依然分散且未系统化。我们在此框架内对这些风险进行了系统化的梳理，并将威胁分为两类：数据供应链攻击（瞬态上下文注入和持久内存中毒）以及工具供应链攻击（发现、实现与调用）。此外，我们还识别出“病毒代理循环”，在这种情况下，即使不利用代码层面的漏洞，代理也能作为自我传播生成型蠕虫的载体。最后，我们倡导采用零信任运行时架构，在这种架构中，将上下文视为不可信的控制流，并通过加密来源而非语义推理来限制工具执行。
URL
https://arxiv.org/abs/2602.19555
