Append-only. Newest entries at the bottom.
2026-07-29 — Initial ingest
Sources ingested: raw/Supply-chain-attacks/ — 8 files, ~39,400 words, added by the user. This was the vault’s last empty source folder.
| Source | Words | Type |
|---|---|---|
Aisecurecode.md — Perry, Srivastava, Kumar & Boneh, ACM CCS ‘23 | 10,243 | Peer-reviewed study |
sc-report-final.md — Plexal & Oxford GCSCC, March 2026 (LASR-supported) | 7,705 | Institutional research |
| Security-Focused Guide for AI Code Assistant Instructions | 7,125 | OpenSSF (vendor-neutral) |
| AI Security Best Practices (LLMs and AI-powered apps) | 6,013 | StackHawk (vendor) |
| 4 Best Practices for AI Code Security | 3,499 | StackHawk (vendor) |
| AI Supply Chain Security: Why It’s Becoming Harder to Ignore | 2,392 | Wiz (vendor, with original research) |
| Same same but also different: Google guidance | 1,320 | Google Cloud |
| Understanding and Addressing Supply Chain Risks in AI Systems | 1,092 | LinkedIn post |
Coverage: the two primary sources read in depth (taxonomy, risks, mitigations sections of the Plexal/Oxford report; abstract, introduction and findings of the Stanford paper). Others read in full or at section level.
Scope mismatch, recorded deliberately: the folder is named for supply chain, but three sources (Stanford study, OpenSSF instructions, StackHawk LLM app security) are about AI coding assistants and LLM application security. Pages follow the CLAUDE.md raw-folder convention and stay here, with prominent cross-links to secure-coding-patterns-wiki and a note on the index. Moving them would break the folder-pairing convention; leaving them unlinked would hide them. Cross-linking both ways was the compromise.
Pages created (8): index.md, log.md, ai-supply-chain.md, supply-chain-attacks.md, provenance-and-assurance.md, do-users-write-insecure-code.md, ai-assistant-instructions.md, securing-llm-applications.md
Findings recorded:
- 78% of workshop participants had limited/partial visibility of their AI supply chain; 28% had changed vendors over trust or compliance issues.
- Five-layer taxonomy: hardware → compute infrastructure → AI core (data/algorithm/model) → deployment → integration & UI. Guardrails sit in the integration layer, making them a supply-chain component with their own provenance question.
- The CIA triad is insufficient — Plexal/Oxford add explainability, fairness, robustness, reproducibility, accountability. Independently overlaps NIST’s trustworthiness characteristics. Note this contradicts the CISA definition of “AI cybersecurity incident” in the OWASP glossary, which is purely CIA-framed; recorded on
ai-supply-chain.md. - Stanford: participants with an AI assistant wrote insecure solutions more often in 4 of 5 tasks, and were more likely to believe their code was secure. Prompt discipline (task instructions, function declarations, helper-function focus) improved outcomes; reusing model output as the next prompt magnified flaws.
- Real incidents: Ultralytics (cryptomining via compromised GitHub library), s1ngularity (payloads in model artifacts), CVE-2025-23266 “NVIDIAScape” (privileged GPU runtime).
- OpenSSF advises against persona priming — “telling the system it is an expert often makes it perform poorly or worse.” Cuts against common prompt-engineering advice, and is the defensive mirror of PITAX T01 persona modulation. Flagged as provisional by OpenSSF.
- OpenSSF: models “can often self-identify” hallucinated package names if asked — a cheap second-pass check against slopsquatting.
Citation discrepancy recorded: OpenSSF cites Spracklen et al. for “19.7% proposed packages did not exist”; Orca cites the same study for 5.2% (commercial) / 21.7% (open-source) — see secure-coding-patterns-wiki/slopsquatting.md. Different slices of one dataset rather than conflicting findings, but no single number should be quoted without naming its population. Neither source reproduces the paper directly. Noted on ai-assistant-instructions.md.
Gap opened: multimodal prompt injection (instructions embedded in images that vision models follow) has no PITAX technique and no ATLAS technique in the current corpus. Nearest are T26 Spatial Byte Arrays and T03 Binary Streams, neither of which covers vision-model instruction-following. Recorded on securing-llm-applications.md and the index.
Gaps closed: last empty source folder; the “secure patterns for building LLM applications” gap flagged by secure-coding-patterns-wiki; and the absence of vendor-independent empirical evidence on AI coding risk.
Existing pages updated: root index.md (collection added, empty-folder section removed); secure-coding-patterns-wiki/index.md and securing-the-ai-sdlc.md; slopsquatting.md; owasp-llm-top-10-wiki/the-ten-risks.md.
Open items:
- The Spracklen et al. slopsquatting paper is cited by two sources with different numbers and present in neither. Highest-value follow-up.
- Google’s Securing the AI Software Supply Chain research paper is referenced but not present.
- CoSAI’s “Establish Risks and Controls for the AI Supply Chain V1.0” is cited by the Plexal/Oxford report — would pair with the CoSAI IR framework already flagged as missing in
ai-incident-response-wiki. - NIST SSDF (SP 800-218) still absent, still the top gap for
secure-coding-patterns-wiki.
2026-07-29 — Wiki-wide audit fallout
A full-wiki audit found that ingesting this collection left 10 stale claims across 6 other collections still asserting raw/Supply-chain-attacks/ was empty. All corrected and repointed at this collection. Two superlative claims were also superseded and rewritten: OWASP LLM03 was described as “the vault’s only substantial supply-chain source,” and the crosswalk table listed LLM03’s vault column as “gap — folder empty”.
Lesson recorded for future ingests: when a collection is created, grep the whole wiki for the folder name before declaring the ingest done. Root-index and same-collection updates are not sufficient; gap statements propagate across collections.