AI Supply Chain Compromise
Adversaries may gain initial access to a system by compromising the unique portions of the AI supply chain. This could include Hardware, Data and its annotations, parts of the AI AI Software stack, or the Model itself. In some instances the attacker will need secondary access to fully carry out an attack using compromised components of the supply chain.
> sub-techniques
> curated attacks (9)
Malicious Dataset RCE in Hugging Face's Processing Pipeline
A crafted dataset chained two flaws in Hugging Face's dataset-processing pipeline — a remote-code dataset loader and a template-injection bug in dataset config — turning routine ingestion into arbitrary code execution, then credential theft and lateral movement into internal clusters.
Fake OpenAI 'Privacy Filter' Model on Hugging Face Pushes Infostealer
A repository typosquatting OpenAI's Privacy Filter release copied the model card nearly verbatim and shipped a loader that fetched and ran infostealer malware. It hit #1 trending on Hugging Face with 244,000+ downloads in under 18 hours.
Poisoned Postmark MCP Server Exfiltrates Email
A popular MCP server for the Postmark email service was trojanized in a supply-chain 'rug pull': a new version silently BCC'd users' emails to an attacker. Every agent wired to the tool leaked mail automatically.
Amazon Q VS Code Extension: Wiper Prompt via Supply-Chain Compromise
An attacker gained write access to the open-source Amazon Q VS Code extension repo and slipped a prompt into an official release instructing the AI agent to wipe the local filesystem and cloud resources. It shipped to users before AWS pulled it — the payload failed only due to a syntax error.
Rules File Backdoor: Poisoning AI Coding-Assistant Config
Hidden, obfuscated instructions planted in a shared 'rules file' silently steered AI coding assistants like Cursor and GitHub Copilot to inject malicious code — a supply-chain backdoor invisible in normal review.
nullifAI: Malicious Pickle Models Evading Hugging Face Scanning
Two models on Hugging Face carried reverse-shell payloads in broken Pickle files, deliberately malformed and 7z-compressed to slip past Picklescan. Loading the model opened a connection back to the attacker — RCE via the model artifact itself.
Organization Confusion on Hugging Face: Impersonation to Reverse Shell
A researcher registered Hugging Face organization accounts impersonating real companies. Employees uploaded private models to the fake orgs — which could be swapped for poisoned models carrying reverse-shell payloads that execute when loaded.
PoisonGPT: Surgically Backdoored Model on a Public Hub
Researchers edited a single fact into an open LLM using ROME, uploaded it under a name resembling a trusted org, and showed the poisoned model passing standard benchmarks while emitting targeted misinformation — an AI supply-chain compromise.
Compromised PyTorch Dependency Chain (torchtriton)
For six days, PyTorch's nightly builds pulled a malicious 'torchtriton' package from PyPI via dependency confusion. On install it ran a binary that exfiltrated system info, environment variables, and SSH keys.