Tag
7 articles tagged Supply Chain.
AI Security
Storm-0940 did not need a single user password: it signed in as a trusted vendor application. Here is what happened, what to check in your tenant, and how to shrink the access third-party apps hold.
AI Governance
An AI-BOM lists the models, datasets, and software inside an AI system in a machine-readable form. Here is what to put in one, which standard fields to use, and how to make it enforceable.
Privacy
A model aggregator sees every prompt, upload, and output you send through it. The 302.ai exposure shows why that makes it a data processor to vet, not just an API to call.
AI Security
The LiteLLM 1.107.0 release on PyPI and its Docker images carried a credential stealer that runs on every Python start. Here is what it did, how to tell if you were hit, and what to rotate.
AI Security
An AI agent in a GitHub Actions workflow reads attacker-controlled text while holding your tokens. Here is the threat model and a workflow design that keeps a successful prompt injection from reaching secrets.
AI Security
Connecting an MCP server hands its author a voice in your agent's context and, often, code execution on your machine. Here is how to review one before you connect it and keep it honest afterwards.
AI Security
A downloaded model checkpoint is not just data. If it is a pickle, loading it can execute code. Here is how to load third-party weights without handing that file a shell.
