LLM03: Supply Chain Vulnerabilities
Risk Level: High
The LLM application supply chain includes pre-trained models, third-party datasets, plugins, fine-tuning data, and deployment platforms. Compromised components can introduce backdoors, data leaks, or malicious functionality that is difficult to detect through traditional code review. This includes poisoned models on public repositories, compromised training datasets, and vulnerable third-party integrations.
Real-World Example (March 2026)
Researchers disclosed 37 vulnerabilities across 15+ AI IDE vendors, including a zero-click MCP (Model Context Protocol) autoload attack. Malicious MCP tools — the AI IDE equivalent of browser extensions — auto-loaded without trust prompts and spawned reverse shells with developer permissions. This is supply chain compromise through AI tooling: the "plugin" is the attack vector. Full breakdown →
Mitigations
- Maintain an AI Bill of Materials (AI-BOM) listing all models, datasets, plugins, and their sources
- Verify model integrity using cryptographic hashes before deployment
- Use only models and plugins from trusted, reputable sources with security track records
- Scan third-party plugins for vulnerabilities and excessive permission requests
- Implement model signing and attestation workflows