For about three hours one day in March 2026, a backdoor sat inside LiteLLM — the language-model gateway that CrewAI, DSPy, Microsoft GraphRAG and dozens of other agent frameworks depend on — waiting on the PyPI package registry. In that window, roughly 47,000 downloads pulled the compromised version, and with it an autonomous attack bot. Nobody who got hit typed a malicious prompt. They ran pip install. The attack arrived through the supply chain.

That incident is a clean illustration of the year’s most important shift in AI security, and it’s one a lot of teams still haven’t internalised. For a couple of years “prompt injection” meant a clever attacker typing something devious into a chat box. In 2026 the attack surface moved off the keyboard entirely. Your agent no longer gets compromised mainly by what a user types. It gets compromised by what it reads — the packages it depends on, the tool servers it connects to, the skills it installs.

For the rest of us: what changed

Prompt injection is the family of attacks that manipulate an AI through its input rather than by breaking its code. The classic, well-understood version is text-based: an attacker hides instructions in a message, a web page, or a document, and the model — which can’t fully separate “data to process” from “instructions to follow” — obeys them.

The new version has the same shape but a different delivery. An agent doesn’t just read the user’s message. To do its job it pulls in software dependencies, connects to tool servers over the Model Context Protocol (MCP), and loads reusable “skills” from registries. Every one of those is input the agent trusts and acts on — and every one is a place an attacker can hide instructions or code. The malicious input still arrives; it just comes through the toolchain now, not the prompt box.

The surface moved

The 2026 incident record makes the shift concrete, and OWASP’s GenAI security work this year puts exactly these vectors — not typed prompts — at the center of agentic risk. Three examples, all verified, all from the first few months of the year:

  • Poisoned dependencies. The LiteLLM backdoor above is the archetype: compromise one widely-depended-on package and you reach every agent framework built on top of it, at install time, before a single prompt is written.
  • Vulnerable tool servers. Between January and February 2026, researchers filed more than thirty CVEs against MCP servers and clients. The most severe, CVE-2025-6514, carried a near-maximum CVSS score of 9.6 and affected the widely used mcp-remote proxy across more than 437,000 installed environments. An agent that connects to a compromised tool server is taking instructions from it.
  • Malicious skills. As agents load reusable skills from marketplaces and registries, a poisoned skill becomes a way to smuggle behaviour into any agent that installs it — the same distribution risk that browser extensions and app stores have always carried, now pointed at autonomous software.

None of these is a typed prompt. All of them are prompt injection in the sense that matters: untrusted input steering the agent to do something it shouldn’t. The keyboard was never the point. The trust was.

Why this is sharper for agents than for chatbots

A chatbot reads one thing: your message. An agent reads dozens of things you never see — config files, tool descriptions, dependency code, skill definitions, the outputs of other tools — and, crucially, it acts on them autonomously. That combination is what makes the toolchain vector so much worse than the classic one. A prompt-injected chatbot gives a bad answer you can catch. A supply-chain-compromised agent takes a real action — moves a file, sends a request, calls another tool — using permissions you granted it, through a chain you can’t fully see. The blast radius isn’t a wrong sentence. It’s behaviour.

What this means

The good news is that this isn’t a mysterious new class of threat requiring a new discipline. It’s software supply-chain security, which the industry already knows how to do — it just now applies to a surface most teams weren’t watching. The moves are the familiar ones, redirected: maintain a bill of materials for what your agents actually load, not just your application code. Pin dependencies and verify provenance instead of pulling latest. Vet MCP servers and skills before you wire them in, the way you’d vet any third-party code with production access. Give agents least-privilege credentials so a compromised tool can’t do everything. And watch the toolchain, not just the prompt logs, because that’s where the 2026 attacks actually live.

I feel the size of this surface every day. Wiring MCP servers and skills into Hermes, my home-server agent, is most of what “improving” it means now — and every one of those is a new thing I’ve decided to trust with access to my systems. At home that’s a manageable risk I take knowingly. In an enterprise running hundreds of agents that each pull in dozens of tools, “what has my agent decided to trust, and who built it?” is a question the security team needs to be able to answer — because the honest version of prompt injection in 2026 isn’t what your users type. It’s what your agents were built from.

References