AI Supply Chain Compromises: 7 Entry Points Your Security Review Probably Misses

Artificial intelligence systems rely heavily on external components, making them vulnerable to supply chain compromises. MITRE ATLAS and OWASP Top 10 for LLM Applications 2025 recognize ML Supply Chain Compromise as a significant risk. This type of attack exploits seven potential entry points that frequently go unnoticed during security reviews.

Firstly, attackers can manipulate model files, exploiting formats like Python's pickle that can execute arbitrary code upon loading. In 2024, JFrog found around 100 malicious models on Hugging Face, and ReversingLabs discovered nullifAI, a deliberately broken pickle file that executed its payload. To mitigate this risk, developers should prefer safer file formats, use PyTorch's default weight loading, and isolate third-party models.

Secondly, attackers can introduce backdoors or tamper with models without altering their loading behavior. PoisonGPT (2023) and Sleeper Agents (Anthropic, 2024) demonstrated this by subtly altering GPT-J models to spread false information or trigger specific behaviors, respectively. Behavioral testing through red teaming is the only way to detect these types of compromises.

Thirdly, data poisoning can influence models by contaminating training or fine-tuning datasets. Carlini et al. (2023) showed that poisoning 0.01% of LAION-400M, a dataset distributed as URL lists, would cost approximately $60. In October 2025, researchers found that as few as 500 poisoned documents could implant a backdoor in models ranging from 600M to 13B parameters. Preventative measures include tracking data provenance, regularly hashing datasets, and conducting anomaly checks before fine-tuning.

Fourthly, compromised machine learning dependencies and build pipelines pose risks due to classic package-manager vulnerabilities. torchtriton (December 2022) fell victim to a dependency confusion attack that exfiltrated system data. Ultralytics (December 2024) experienced a similar attack via GitHub Actions that installed a cryptominer in the YOLO library.

To counteract these threats, developers should pin package versions with hashes, use private mirrors for critical packages, and harden Continuous Integration (CI) workflows to prevent untrusted input during build steps.

Fifthly, the rise of AI-generated package suggestions can lead to "slopsquatting," where attackers register non-existent package names. A 2025 study found that nearly one in five package recommendations from LLMs were non-existent, with many recurring across prompts. Developers should never install dependencies suggested by AI without verifying their existence and history.

Sixthly, compromised AI coding assistants and extensions become part of the supply chain. Hidden Unicode characters in configuration files can subtly steer generated code (Pillar Security, 2025). More recently, the Amazon Q Developer extension (July 2025) contained a malicious prompt that instructed the assistant to wipe local and cloud resources. Developers should treat rules files and agent configurations as code, review and restrict write access, and run assistants with minimal required permissions.

Lastly, Model Context Protocol (MCP) servers and tools introduce direct lines of communication between agents and external resources. The STDIO transport in the official MCP SDKs can execute hidden instructions contained within server configurations. In April 2026, OX Security disclosed this flaw, demonstrating how malicious packages or prompt injections could grant attackers code execution on host machines.

To mitigate this risk, developers should allowlist trusted MCP servers, pin their versions, require human approval for any configuration changes, and isolate servers from sensitive resources.