Summary: Five attack paths, with documented real-world incidents — a hijacked AI library shipping cryptominers, malicious payloads in model artifacts, and privileged GPU-runtime escapes.
Sources: raw/Supply-chain-attacks/AI Supply Chain Security_ Why It's Becoming Harder to Ignore.md (Wiz Research); sc-report-final.md (Plexal & Oxford GCSCC); Understanding and Addressing Supply Chain Risks in AI Systems.md
Last updated: 2026-07-29
The shape of these attacks
“Most AI supply chain attacks don’t begin with a dramatic breach. They start with small compromises in trusted components – training environments, dependencies, or model artifacts – that quietly move downstream into production.”
(source: Wiz)
Five attack paths
1. The training and runtime environment. “AI workloads often rely on highly privileged GPU drivers, container runtimes, and low-level libraries.” Wiz Research cites CVE-2025-23266 (“NVIDIAScape”) as a case where infrastructure vulnerabilities “expose entire environments, allowing attackers to escalate privileges or access sensitive workloads running on shared systems.”
The privilege level is the point — GPU stacks run closer to the metal than most application dependencies, and they are shared across tenants.
2. Open-source AI libraries and repositories. The Ultralytics incident: attackers “compromised widely used AI libraries and injected malicious code that performed cryptomining once deployed—spreading silently into training and inference environments,” delivered via GitHub.
3. Model artifacts and serialized files. “Trained models are often treated as static assets, but unsafe serialization formats can execute code when models are loaded.” Wiz cites the s1ngularity attack, “turning the model loading process itself into an execution vector.”
This is the same mechanism OWASP LLM04 names as malicious pickling. Two independent sources, same finding: model.load() is a code-execution sink.
4. Third-party integrations and dependencies. External models, weights, tokenizers and configuration files, where “malicious code can propagate into AI workflows without exploiting traditional application vulnerabilities.”
5. Exposed inference endpoints. “Even without access to infrastructure or source code, adversaries can probe models through repeated queries, enabling extraction of model behavior or inference of training data. These attacks blend easily into normal traffic.”
That is model extraction framed as a supply-chain concern — the model itself is the exfiltrated component.
Why detection fails
“A compromised dependency still looks like a legitimate library. A poisoned model behaves normally most of the time. A vulnerable runtime component operates as expected until it’s exploited. Attackers don’t need to compromise the entire AI pipeline – just one trusted link and the supply chain does the rest.”
Each clause maps to something already in the vault:
- “Poisoned model behaves normally most of the time” → backdoor poisoning and OWASP’s sleeper agent framing
- “Compromised dependency still looks legitimate” → slopsquatting, where the package is not merely plausible but recommended by your own tooling
- Detection lags of 6–24 months for poisoning (thresholds)
Organisational challenges
The Plexal/Oxford report’s list, which is about visibility rather than technique:
- “Lack of transparency into security practices of third-party service providers”
- “Unclear accountability across the supply chain”
- “Difficulty in obtaining assurance due to lack of metrics and standards for assured service provision”
- “Many systems rely on unvetted open-source components, including data, model architectures and supporting libraries, without provenance tracking”
And at the organisational level: “rapid scaling of AI initiatives without appropriate controls, the ease of spinning up uncontrolled Proofs-of-Concept and the general lack of AI security governance or strategy.”
“Shadow AI and shadow data practices, where models are developed or used without oversight, are increasingly common alongside immature resilience practices and a tendency for employees to bypass security policies in favour of speed or innovation.”
Shadow AI recurs across the corpus as the precondition that defeats everything else — Cycode makes the identical point in AI-generated code risk: without knowing which tools are in use, “there can be no meaningful enforcement of security controls.”
Cascade is the systemic property
The report: “When the data, model and deployment systems are re-used without further validation, these vulnerabilities can cascade across deployments downstream.”
This is what makes supply chain the highest-impact class in both sources that rank it — the health care poisoning review’s SolarWinds analogy (“a single vendor compromise can affect hundreds of institutions”) and Snyk’s matrix placing supply chain at low resources / very high detection difficulty.
Where it maps
| Framework | Placement |
|---|---|
| OWASP LLM03 | Supply Chain — third-party models and data, LoRA/PEFT hubs, on-device LLMs |
| OWASP LLM04 | Malicious pickling — code execution on model load |
| ATLAS | Resource Development; Initial Access |
| AI Act Art 15(5) | “model poisoning” (pre-trained components used in training) — the closest fit |
| CoP Appendix 4.4 | ”Inspect training data for tampering or sabotage” |