PreviewYou're previewing CTO AI Forge. Sign in to use it.Sign in
← All lessons
L4 · Agentic engineering: agents in CI/CD, guardrails, quality and security9 min read

Prompt injection and the AI tool supply chain

Coding agents and AI features read text from many places: issues, pull request comments, web pages, documentation, dependencies, MCP servers. Any of that text can contain instructions. Prompt injection is when an attacker's text steers the model into doing something its user didn't intend — leaking secrets, changing code, calling a destructive tool.

Why it is hard

Models don't reliably separate "instructions from my user" from "data I am reading". There is no complete fix today; defense is about limiting what a successful injection can do.

The AI tool supply chain

The tools themselves are software with a supply chain. In July 2025, AWS published security bulletin AWS-2025-015: a GitHub token with excessive permissions in a build configuration was compromised, and the attacker injected malicious code into the open-source repository of the Amazon Q Developer extension for VS Code, which shipped in version 1.84.0. AWS said the code was distributed but failed to execute due to a syntax error; it revoked the credentials and released 1.85.0. BleepingComputer reported that the injected text was a prompt telling the agent its goal was "to clear a system to a near-factory state and delete file-system and cloud resources".

The lesson: AI extensions, agent tools and MCP servers run with your developers' privileges. A compromised tool is a compromised developer machine — or worse.

A risk framework

The OWASP Top 10 for LLM Applications (2025) is a practical checklist. Its entries include prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation and unbounded consumption.

Controls

  1. Inventory and pin AI extensions, agents and MCP servers; allow-list approved versions.
  2. Least agency: give agents only the tools and scopes the task needs; require approval for destructive or external actions.
  3. Separate untrusted content from privileged steps; never expose secrets to steps processing public input.
  4. Egress control: limit where agents can send data.
  5. Output handling: treat model output as untrusted input to other systems.
  6. Monitor tool calls and alert on unusual patterns.

What this means for the CTO

Add AI tools, extensions and MCP servers to your software supply-chain program: inventory, approval, version pinning and monitoring. Ask your security team to threat-model each agent against the OWASP LLM Top 10, with special attention to excessive agency.

The key question for every new agent integration: if an attacker controlled the text it reads, what could it do? Shrink that answer until it is acceptable.

Treat a compromised AI extension like any other endpoint compromise in your incident playbooks: who rotates credentials, who checks which repositories and cloud accounts the affected developers could reach, and how fast you can remove a bad version everywhere.

Real example

AWS security bulletin AWS-2025-015 (July 23, 2025; CVE-2025-8217) states that a GitHub token with excessive permissions in a CodeBuild configuration was compromised and used to inject malicious code into the Amazon Q Developer extension for VS Code, shipped in version 1.84.0; the code failed to execute due to a syntax error, and AWS revoked the credentials and released version 1.85.0. Source: AWS Security Bulletin AWS-2025-015 — Security update for Amazon Q Developer Extension for VS Code (Jul 23, 2025) ↗

Use it

Quick check · 3 questions

  1. 1.Why can't prompt injection be fully prevented today?

  2. 2.Which OWASP LLM Top 10 risk is about agents having more tools or permissions than needed?

  3. 3.What was the root cause in the Amazon Q extension incident, per AWS?

0 of 3 answered

Sources

Last reviewed 2026-10-01.