I am curious how is your example add function that allows an LLM to read files or environment variables and send the stolen data to another server is different from data exfiltration supply chain attack? To me it looks like that this type of attack isn't inherent to LLM-based applications.