Dynamic Trust Drift in Agentic AI Supply Chains: A Framework for Detecting Context Poisoning, Post-Authorization Tool Behavior Changes, and Credential Exfiltration

Agentic AI systems make plans, make call, take notes and delegate to other agents. They thus take on the security characteristics of all the components they depend on for their security. When a tool or agent is first trusted, that trust slowly tarnishes over time due to "poisoned context" or to new behaviors by the tool, or to hidden credential leakage by it. This paper formalizes the phenomenon as dynamic trust drift and introduces a modular approach to detecting it containing the following modules: A Context Integrity Monitor, a Tool Behavior Profiler, a Credential Flow Tracker, a Dynamic Trust Scorer, a Policy Enforcement Gate and a Supply-Chain Attestation module. The framework was tested with the provided study data consisting of 51 session turns, 5 attack classes, 6 ablation configurations and 6 supply-chain nodes. It had an average F1 Score of 0.917 for the three types of attack and false positive rates ranging from 0.03 to 0.06. Combine: Trust in unprotected sessions decreased from 0.962 to 0.150 in 50 turns and framework protected sessions remained constant between 0.923 and 0.962. The ablation study revealed that every module is essential to every attack class it is targeted and that removing the F1 module dropped the class value in the ablation study by 0.215 to 0.265. Trust was given to an email agent in the supply chain as critical, with trust score of 0.50. The primary drawback is performance in the zero-day variants (F1 = 0.805).