LLM03: Supply Chain Vulnerabilities in AI Systems

Here is an example of Python code that is vulnerable to AI supply chain compromise:

🥺 Vulnerable Code

from transformers import AutoModelForCausalLM, AutoTokenizer

# Vulnerable: unverified publisher, no pinned revision, remote code allowed
model = AutoModelForCausalLM.from_pretrained(
    "some-user/fast-support-model",
    trust_remote_code=True,
)
tokenizer = AutoTokenizer.from_pretrained("some-user/fast-support-model")

# requirements.txt in the same repo:
#   langchain
#   llama-index
#   mcp-server-utils        <- nobody checked who publishes this

trust_remote_code=True executes Python that ships with the model repository, at load time, with your service account's permissions. Without a pinned revision the weights you test are not necessarily the weights you deploy, and legacy pickle checkpoints run code when they are loaded. The unpinned dependency list adds the usual problems on top: typosquatted packages, hijacked maintainer accounts, and an MCP server nobody vetted.

😎 Secure Code

Here is a version of the same code that is secured against AI supply chain compromise:

from transformers import AutoModelForCausalLM

MODEL_ID = "org/support-model"
MODEL_REVISION = "9f1c2d3a4b5c6d7e8f90112233445566778899aa"   # pinned commit hash

model = AutoModelForCausalLM.from_pretrained(
    MODEL_ID,
    revision=MODEL_REVISION,
    trust_remote_code=False,      # no repository code is executed
    use_safetensors=True,         # no pickle deserialization
    local_files_only=True,        # served from an internal, scanned mirror
)

# CI gate before anything reaches an environment:
#   pip install --require-hashes -r requirements.lock
#   syft dir:. -o spdx-json > sbom.json
#   grype sbom:sbom.json --fail-on high

Pinning the revision makes the artifact reproducible, safetensors removes the code execution path in the format itself, and refusing remote code means a compromised repository cannot run anything during load. Mirror approved models internally, scan them, and record their checksums. Treat models, agent frameworks, plugins, and MCP servers as dependencies: lock them with hashes, generate an SBOM, and fail the build on known-vulnerable versions.

Security Resources

🥺 Vulnerable Code

😎 Secure Code