What is different about AI

A conventional supply chain is mostly code. An AI system also depends on model weights, which cannot be read like code; training data, which shapes behaviour invisibly; and connected tools, which can instruct the model while it runs. Each can be tampered with, and some tampering survives testing; see model backdoor.

The main attack routes

  • Malicious model files. Some model file formats, notably Python's pickle, can execute code when loaded. In February 2025 ReversingLabs found models on Hugging Face that used deliberately broken pickle files to run code while evading the platform's scanner. Downloading a model can mean running someone else's code.
  • Poisoned or backdoored models and data, through data poisoning or altered weights shared on public hubs.
  • Invented dependencies: packages suggested by AI coding tools that do not exist until an attacker registers them; see slopsquatting.
  • Untrusted tools and plug-ins, such as Model Context Protocol servers that change their behaviour after approval.
  • Upstream changes: a hosted model updated by its provider without notice.

How it differs from third-party risk

Third-party risk is about the commercial and contractual relationship with suppliers: due diligence, contracts, concentration and exit. AI supply chain security is about the technical integrity of what they deliver. A reputable supplier can still ship a compromised component, and an open-source model comes with no supplier relationship at all.

What good looks like

  • Know what you have: an AI bill of materials for each system, linked from the AI inventory.
  • Prefer safe formats: load model weights in formats that cannot execute code, such as safetensors, and scan anything that can.
  • Verify integrity: check signatures and hashes on models and datasets. OpenSSF's model signing specification, released as version 1.0 in April 2025, applies Sigstore signing to model files; see model artefact signing and integrity verification.
  • Control sources: pull models, datasets and packages through approved internal registries rather than directly from public hubs.
  • Record provenance for training and fine-tuning data; see training data provenance checks.

Frequently asked questions

What is AI supply chain security? Protecting the integrity and provenance of the models, datasets, libraries and tools an AI system is built from.

Can downloading an AI model be dangerous? Yes. Some model file formats can execute code when loaded, and malicious models have been found on public hubs.

What is an AI bill of materials? A machine-readable inventory of the models, datasets and dependencies in an AI system, used to find what is affected when a component is compromised.

Where it sits in the register

LLM application supply chain vulnerabilities is OWASP's LLM04 in register form, with third-party model and dataset provenance and model backdoors and trojans beside it.