Supply chain attack

An attack that compromises software or services upstream of the target organization, so the malicious payload is delivered through a trusted distribution channel. For AI agent skills, the supply chain attack vector is ClawHub: an attacker publishes a skill that appears legitimate and accumulates installs before the malicious payload is detected. The ClawHavoc campaign is the canonical example of an AI agent skill supply chain attack at scale.

Related terms