What is a supply chain attack?
A supply chain attack is one in which the attacker reaches the target through a supplier, a component or a tool the target already trusts.
Instead of attacking the organisation directly, the attacker goes after something the organisation brings in from outside. That might be a software library, an update, an add-on or a service provider with access to its systems. The malicious code then comes in through a channel that has already been approved.
With AI the supply chain has grown longer. Beyond ordinary program code, organisations download language models, model files, datasets and add-ons for AI agents, often from open platforms where anyone can publish. OWASP counts supply chain weaknesses among the main risks for applications built on language models.
Common tricks include packages with misspelt names, hijacked accounts belonging to whoever maintains a component, and malicious versions of something that used to be trustworthy. An attack can also hide in a model file that runs code when it is loaded.
How it works
The attacker looks for the weakest link between a component and its users. That might be an account belonging to whoever maintains a package, an access token in a build pipeline or a name that resembles a popular package. Once the malicious version is published, it spreads through ordinary updates.
An example. A developer installs a package suggested by a coding assistant. The name exists, but the package was registered by someone other than the developer assumed, and it searches the computer for passwords.
Why it matters
A single attack can reach many organisations at once, because they rely on the same component. With AI, model files and add-ons for AI agents come on top, and they often run with broad permissions.
What to keep in mind
Pin versions and review new ones before they are let in. Route automatic updates through a test environment.
Keep an inventory of what is in use, an SBOM, and name an owner for every important component.
What it means for you
Treat everything you bring in from outside as part of your own security. Approve models, packages and add-ons before they are used, and keep an inventory that shows what is where.
Common questions
Is open source more exposed to supply chain attacks?
Open package registries and model platforms are easy to publish to, which attackers exploit. At the same time, open code can be inspected. What matters is that everything you bring in is approved and followed up, wherever it comes from.
How do we notice that a component has turned malicious?
Often through a warning from the maintainer or a security agency. With an SBOM you can quickly see whether the affected version is in use.
Can an AI agent make the risk greater?
Yes, if the agent installs packages or add-ons a model suggests on its own. Let that happen in a sandbox and require approval before anything moves to the real environment.
Sources: NIST on supply chain attackNCSC on supply chain securityOWASP, LLM03 Supply Chain
Related terms
Read more
All terms Updated