AI Supply Chain Risks Escalate as Organizations Consume, Not Build, Models
Organizations increasingly relying on third-party AI models and open-source repositories face significant, often unseen, supply chain risks that mirror traditional software vulnerabilities.
The rapid adoption of artificial intelligence by organizations is creating a new and complex attack surface, often referred to as the AI supply chain. Unlike traditional software development where organizations control the entire pipeline, many are now consuming AI services, primarily through API calls to major providers like OpenAI, Anthropic, and Google, or by integrating open-source models from platforms such as Hugging Face. This shift means organizations inherit upstream risks related to training data, model updates, API security, and data handling with limited visibility.
The AI supply chain can be broadly categorized into four interconnected layers, each presenting unique vulnerabilities. The first layer consists of third-party model APIs and pre-built services, which is the dominant model for most enterprises. This layer introduces risks such as unpredictable model updates without versioning or notifications, data transit through unowned infrastructure with varying data residency and retention policies, and the common issue of hard-coded API keys acting as potent data exfiltration vectors. Vendor concentration also poses a resilience risk, as deep integration with a single provider leaves organizations vulnerable to service disruptions or pricing changes.
The second layer involves open-source model repositories, which have become the de facto standard for many AI development efforts. These repositories, akin to the npm ecosystem for traditional software, host a vast number of model artifacts with inconsistent vetting processes. Researchers have identified malicious models mimicking legitimate ones, leading to dependency confusion attacks. Specific risks include the use of vulnerable pickle file serialization, which allows arbitrary code execution upon loading, typosquatting where attackers register models with names similar to popular ones, and the circulation of malicious LoRA (Low-Rank Adaptation) adapters that can subtly alter base model behavior without conventional security tool detection.
The third layer comprises orchestration frameworks like LangChain, LlamaIndex, and AutoGen, which connect AI models to internal data, external tools, and other agents. While these frameworks carry standard software supply chain risks such as vulnerable dependencies and insecure defaults, they also introduce AI-specific threats. A significant concern is prompt injection via data sources, where malicious instructions embedded in retrieved content can manipulate model behavior. Furthermore, the integration of models with sensitive internal data amplifies the potential impact of any compromise within this layer.
The final layer is the underlying cloud and physical infrastructure. While not unique to AI, the scale and velocity at which AI systems are deployed exacerbate the risks associated with this foundational layer. The combination of these four layers, deployed rapidly and often without adequate security frameworks, presents what experts are calling the most consequential security challenge of this decade. Organizations are urged to apply existing security disciplines, such as rigorous vendor assessment, internal approved model registries, blocking insecure serialization formats, and implementing robust secret management, to mitigate these emergent threats.