The Four-Gate Boundary: Stopping AI Supply-Chain Attacks
AI agents fail when untrusted content is treated as a command. The four-gate boundary sets the identity, capability, flow and execution checks that stop it.
Yash Sharma5 min readSecure LLM and agent execution
Research area 37: Security, adversarial-defense and supply-chain engineering
In brief
- Untrusted content keeps getting promoted into authority it was never granted.
- The four-gate boundary checks identity, capability, information flow and execution before any effect runs.
- Skill poisoning already reaches execution in tested configurations, and a signed or scanned artifact is not proof of safety.
Security, adversarial-defense and supply-chain engineering is the discipline of stopping untrusted content from being treated as an authorized instruction. A retrieved document, a tool response, a skill description or a downloaded dependency can carry text that looks like a command, and 2026's incidents share one failure: content promoted into authority it was never granted. The fix is not a smarter classifier. It is a set of deterministic boundaries an executive can fund, measure and hold someone accountable for.
What it is
The area covers a system that consumes information it did not author and then proposes an action. Direct injection is an adversarial instruction typed straight at the system. Indirect injection hides the same instruction inside data the system encounters on its own: a webpage, a file, a tool's reply. Supply-chain poisoning changes something the system depends on before it runs: a package, a plugin, a skill description, a model or data artifact, or a build input. A confused deputy is a system that uses its own legitimate authority to carry out instructions that arrived from an untrusted source.
Provenance establishes where something came from and whether it has been altered, not whether it is safe: a signed package tells you who produced it, and a malicious author can sign something too. A trust boundary exists to stop data from redefining instructions, policy or authoritative state, and it fails the moment a quoted sentence becomes an executed action without independent authorization.
Why it matters now
Agents now read more of what they act on, and 2026's evidence shows this failure is not hypothetical. A February 2026 disclosure documented an issue-triage agent that let untrusted content reach a continuous-integration cache and, from there, release authority, a mechanism its finder named Clinejection. The maintainer's fix, merged the same month, removed the AI review workflow and the publishing-cache use it depended on.
An April 2026 study built 1,070 synthetic skill-poisoning attacks from 81 seeds across eight configurations. On one model, 25 of 1,070 attempts executed, about 2.3 percent, confidence interval 1.6 to 3.4 percent. A second configuration executed 41 of 1,070, though runtime errors on 61 percent of its runs limit comparison between models. A 2026 calculus for information-flow security proved a scoped noninterference property, then tested it with 1,296 adversarial attempts and recorded two successes, both tied to the same endorsement-dependent exception the proof names.
The architecture
My framework for this is the four-gate boundary: identity, capability, information flow and execution, the same four controls 2026's evidence keeps pointing back to as the place a defense has to hold.
The identity gate authenticates the principal behind an action and labels incoming content with its trust and origin on arrival. The capability gate checks the effect against what that principal is authorized to touch, and caps delegation: a subagent's authority is a subset of what granted it, with the same expiry and revocability. The information-flow gate governs where labeled data may travel inside the system, treating declassification as a privileged, explicit request. The execution gate is where an approved effect runs, in a pinned, isolated environment, only after its artifact and dependencies are integrity verified.
Most 2026 incidents skip straight from the first gate to the fourth: a document is read as if it had cleared the middle two, and an effect executes on a quoted sentence, the pattern behind Clinejection. Classifiers and human confirmation add value at the identity and capability gates but should never be the only barrier before a credentialed effect. All four gates must be enforced by the platform itself, not the model.
Ownership belongs with the security or platform function that operates the gates, not the closest product team, funded and measured at the same priority as model spend.
How to lead it
Two decisions belong to an executive, not an engineering team alone. The first is separating the credentials that let automation act on untrusted input from the credentials that publish a release or modify a build cache, the separation Clinejection's mitigation had to retrofit rather than have by design. The second is setting, before a security test runs, how much residual risk the organization will accept and what attacker budget it must cover: zero successful attacks in a small, fixed test is not the same claim as holding against an adaptive attacker.
What it is worth
The money and risk show up in three places: an incident where untrusted content reaches build or release authority, a real security testing program with isolated environments and adaptive attackers, and a defense that blocks so much legitimate work that people route around it. None of these are visible from an attack-success percentage alone.
Before-and-after comparisons need the same attacker budget and task family on both sides of a change, with benign task completion measured alongside the block rate, since a zero-success result against a small, fixed set of attacks bounds risk only at that sample size, not universally.
What the 2026 evidence supports: skill-poisoning content can reach execution in tested configurations, a scoped information-flow proof can hold within its stated assumptions, and a documented incident's mechanism can be closed with a concrete patch. What it does not support: that these fixes close every related path, that a formal guarantee transfers outside its trusted-enforcement assumptions, or that one benchmark result generalizes to an adaptive attacker. No return figure beyond an organization's own measured boundary decisions should be treated as established.
Questions leaders ask
- Does a digital signature mean a software package or skill is safe to install?
- No. Provenance tools including signatures establish who produced an artifact and whether it has been altered, not whether it is safe. The 2026 evidence is explicit that a signed artifact can still be malicious, since a signature authenticates the signer, not the signer's intent. Treat a valid signature as one input to the capability and execution gates, never as a substitute for isolated testing and integrity verification before use.
- Can a content classifier alone stop prompt injection?
- No. Content classifiers and requiring a human to confirm an action both add value, particularly at the identity and capability stages of the four-gate boundary, but 2026 evidence is explicit that neither should be the only barrier protecting credentials or consequential effects. A classifier can miss a novel phrasing it has not seen, while an enforced capability or execution boundary does not depend on recognizing the attack's wording at all.
- Should an AI agent follow an instruction it finds inside a document it was only asked to read?
- No. A document may legitimately contain a sentence that reads like an instruction, but reading it is not authorization to execute it. The safe pattern is to read the document, extract the requested information and return it, granting no write capability from that step. If a user later explicitly asks for the action described in the document, that becomes a new proposal, evaluated separately against the user's authenticated task.
- What does a security test that reports zero successful attacks actually prove?
- Less than it sounds like. A zero-success result against a fixed, independent set of attacks only bounds risk at that sample size, for example about 9.5 percent one-sided upper risk with 30 independent trials, not zero risk and not resistance to an adaptive attacker. Near-duplicate attacks generated from the same seed should be counted as one data point, not many, or the result overstates its own precision.
- Who should decide when to separate an AI agent's automation credentials from an organization's release credentials?
- An executive, not the engineering team building the agent, because it is a risk and governance decision about what the business will tolerate, not a technical default. A 2026 incident showed what happens when this separation is retrofitted only after an untrusted issue-triage agent reached a build cache and release authority. The fix worked, but the decision to have that separation by design belongs above the team that would otherwise absorb the cost.
