Securing Agent Systems: Injection, Poisoning, and the Skill Supply Chain

The new attack surfaces

Classic application security assumed instructions and data traveled separately. Agents collapsed that: an agent reads text, and text can carry instructions. Three surfaces follow.

1. Prompt injection

Any content the agent processes is a potential instruction channel: web pages it browses, READMEs it ingests, emails it summarizes, even tool outputs. Injection is not exotic; it is the default state of reading the open internet with something that follows instructions.

Defenses are layered because no single one suffices:

• Treat retrieved content as data. Skills and pipelines should quote and analyze external text, never obey it.
• Scan inputs where volume allows (guardrails tooling automates the known patterns).
• Scope permissions so a hijacked agent has nothing worth hijacking: an agent that cannot read secrets cannot leak them.
• Gate consequential actions behind human approval; gates survive novel attacks that scanners miss.

2. Memory poisoning

A hostile or simply wrong write to memory recalls later as trusted fact. Poisoning upgrades a one-shot injection into a persistent compromise: the attack survives the session that carried it.

Defenses live at the write path: provenance on every fact (who wrote it, from what source), write rules that exclude instructions-shaped content, editable stores where corrections are cheap, and consolidation passes with delete authority. Recall-side, the standing rule from the Memory Safety Model applies doubly: recalled facts are claims to re-verify.

3. The skill supply chain

Skills can bundle executable scripts. MCP servers are code by definition. Installing either is dependency adoption with an agent attached, and the marketplaces distributing them scale faster than anyone reviews them.

The discipline is the one you already know from packages, applied without exception: read bundled scripts before team-wide adoption, check boundaries and permission expectations, re-review on updates. The skill evaluation checklist makes the security section explicit.

The order of operations

If you harden one thing at a time, harden in this order:

1. Permission profile (cheapest, broadest): scope file, network, and shell access to the task.
2. Human gates on the enumerated consequential actions.
3. Hook-written audit log: you cannot investigate what you didn't record.
4. Memory write rules with provenance.
5. Input scanning for high-volume ingestion surfaces.

Items 1 through 3 are governance you can ship this week; the checklist covers them. Red-team the result annually or after major changes, and assume any channel the agent reads will eventually be hostile, because on a long enough timeline it will.