Analysis · curated 15 Jul 2026
AI Supply Chain Attacks: How Poisoned Models and Packages Reach Production | infosec.qa
First reported · updated · 3 reports anaconda.com
Coverage timeline
Why it matters
AI supply chain risk — poisoned models and compromised packages — is a growing attack surface for defenders deploying ML and agentic systems in production, and this reference synthesis frames the threat classes and mitigations.
An explainer on AI supply chain and model security describes how poisoned models, compromised open-source packages, and toolchains can reach production, and catalogs common threats to AI models including prompt injection, model extraction/inversion, and dependency risks. It references the NIST AI RMF and cites the 2025 EchoLeak zero-click Microsoft 365 Copilot data-exfiltration vulnerability as an example of injection combining with agentic actions.