Your AI supply chain runs code too

The new AI supply chain

An application with AI depends on far more than its own code. Each of these pieces is written by someone else, arrives through a registry or a marketplace, and runs with your permissions:

• Model weights and files, often downloaded from Hugging Face, in formats that can run code when loaded.
• Datasets for fine-tuning, evaluation and RAG indexes, which decide what the model learns and repeats.
• Packages and SDKs such as AI gateways and agent frameworks, exposed to the same npm and PyPI attacks as any library.
• AI CLIs and IDE extensions, which work with the developer's files, tokens and cloud sessions.
• MCP servers: code that runs on your machine, plus tool descriptions the model reads as instructions.
• Prompts, skills and rules files: natural-language instructions that, as Unit 42 notes about agent skills, run with the agent's full permissions.

OWASP's Top 10 for LLM applications lists supply chain as LLM03 and data and model poisoning as LLM04; its agentic list adds ASI04, agentic supply chain vulnerabilities. The attack surface is not new in kind but in speed: an agent installs, runs and chains these pieces without a human reading them.

Model files and data: code that runs on load

Pickle, the default format for PyTorch weights, can execute arbitrary code when a file is loaded. Hugging Face scans uploads but warns that its scan is not foolproof. The threat is real: in February 2024 JFrog found about 100 models on the hub with genuine malicious payloads, one of which opened a reverse shell on load. A year later, ReversingLabs found two models ("nullifAI") packed as deliberately broken pickle files that evaded Picklescan, the hub's scanner; Hugging Face removed them within 24 hours and updated the tool.

Scale matters too. By April 2025, Protect AI and Hugging Face had scanned 4.47 million model versions in 1.41 million repositories and flagged 352,000 unsafe or suspicious issues across 51,700 models. A safer path exists: safetensors stores tensors without executable code (a 2023 Trail of Bits audit found no critical flaw leading to arbitrary code execution), and PyTorch 2.6 made weights-only loading the default in January 2025.

Weights are not the only vector. In 2025 Pillar Security showed instructions hidden in the chat template of a GGUF file, invisible to scanners that only inspect weights. On data, public numbers about real poisoning of enterprise models are scarce; the documented risk sits in the pipeline. In April 2026 OWASP linked the LiteLLM compromise to a breach at AI data vendor Mercor that put AI labs' training-data workflows at risk, as reported by WIRED.

Hallucinated packages: slopsquatting

Code models sometimes recommend packages that don't exist. A study presented at USENIX Security 2025 (Spracklen et al.) tested 16 code-generating models on 576,000 samples: at least 5.2% of suggested packages were hallucinated for commercial models and 21.7% for open-source ones, yielding 205,474 unique non-existent names. An attacker only has to register the names models keep inventing and wait: that is slopsquatting.

Agents make it concrete. In April 2026 ReversingLabs described PromptMink: an AI coding agent added a malicious npm dependency to a crypto trading-agent project, in a commit co-authored by Claude Opus, exposing wallets. ReversingLabs links the campaign to Famous Chollima, a North Korea-linked group that layers packages to fool coding assistants more than humans.

The practical consequence: an agent that can run npm install or pip install is a new developer with no way of knowing which packages are real. Route its installs through an allowlist or a private registry, and review lockfile changes like any other code.

Attacks that used AI tooling, 2025–2026

Classic supply-chain attacks with a new target: the AI tools on developers' machines.

One more signal: in February 2026, Socket found 19 typosquatted npm packages; one of their modules installed a rogue MCP server whose tool descriptions told coding assistants to read SSH keys, cloud credentials and .env files.

Controls that work, and where they stop

OpenSSF released model signing v1.0 in April 2025 with Google, NVIDIA and HiddenLayer: a library and CLI to sign and verify models of any format or size with Sigstore, self-signed certificates or key pairs. CycloneDX supports an ML-BOM that records models, datasets and their provenance, and SPDX 3.0 includes AI and Dataset profiles. For MCP, Invariant Labs recommends showing full tool descriptions and pinning servers by hash, because a server can change them after you approve it.

EU Cyber Resilience Act: reporting is now mandatory

The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) entered into force on December 10, 2024; its main obligations apply from December 11, 2027, but reporting started on September 11, 2026. Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform, addressed to the CSIRT of their main establishment.

For AI the link is direct: a backdoored dependency such as the LiteLLM versions, actively exploited in your product, starts the 24-hour clock, and without an AI-BOM you cannot tell within a day whether you shipped it. Colombian vendors selling such products in the EU are covered even without an office there; confirm the scope and the competent CSIRT with counsel, using the practical guidance the Commission published in July 2026. If personal data is affected, Law 1581 of 2012 also requires reporting the incident to Colombia's SIC.

Checklist for teams building with AI

1. Keep an AI-BOM: every model, dataset, package, AI CLI, MCP server and skill, with version and owner.
2. Load models only as safetensors, from verified publishers, pinned by hash.
3. Route installs by people and agents through a private registry with an allowlist.
4. Pin dependencies, review lockfile diffs and wait before adopting brand-new releases.
5. Keep CI tokens short-lived and minimally scoped, and require phishing-resistant MFA to publish.
6. Run coding agents and AI CLIs in a sandbox, away from SSH keys, cloud credentials and .env files.
7. Approve MCP servers and skills like vendors: read the descriptions, pin versions and alert on changes.
8. Rehearse the CRA drill: detect, decide and send the early warning within 24 hours.

Where Slash fits: our cybersecurity work covers assessment, hardening and remediation of web apps and APIs, and in a pentest the AI components your application loads are part of the surface we review. Read next: prompt injection, MCP explained and agentic coding.