AI supply chain security: models, dependencies and MCP servers

What makes up an AI supply chain

An AI application inherits the risks of any software and adds new components on top. OWASP covers them under Supply Chain, LLM04 in the 2026 edition of the OWASP Top 10 for LLM Applications and LLM03 in the 2025 edition. Every third-party component either runs with the application's privileges or shapes what the model says, so compromising one compromises the system. These are the pieces to inventory:

• Pre-trained models and adapters, such as LoRA weights, downloaded from public hubs.
• Training, fine-tuning and evaluation datasets.
• Inference, agent orchestration and data processing libraries.
• MCP servers, plugins and tools the agent can use.
• Data pipelines that feed RAG indexes or retraining.

Model files that execute code on load

A downloaded model looks like a data file, but some formats can run code. The best-known case is pickle, the Python serialization format that many machine learning tools have used to save models (.pkl, .pt, .pth or .bin files, among others). Deserializing a pickle lets Python call whatever function the file specifies, so loading a model from an unknown source is the same as running a program from an unknown source.

There are other cases: formats that allow layers with custom code, and libraries with an option to run remote code shipped alongside the model. Models carrying malicious payloads of this kind have been found on public hubs.

Dependencies, impersonated models and hallucinated packages

AI libraries move fast and pull in many dependencies, which favors the classic attacks: lookalike package names (typosquatting), compromised maintainer accounts and dependency confusion between internal and public registries. Model hubs have the same problem: a model published under a name close to a well-known organization can pass for the original.

Coding assistants add a risk of their own. They sometimes recommend packages that do not exist, and an attacker can register those names with malicious code so that whoever follows the suggestion installs it.

A model can also ship with a backdoor in its weights: it behaves normally except when a specific trigger appears. Inspecting the file will not reveal it; only behavioral evaluation can.

Third-party MCP servers and data pipelines

An MCP server installed from a public registry is third-party code running on your machine or with your credentials. On top of the usual dependency risks, it has two of its own. Its tool descriptions enter the model's context and can carry hidden instructions, known as tool poisoning. And the server can change those descriptions or its behavior after you reviewed and approved it.

Data pipelines are another chain of trust. A step that pulls external data, transforms it and hands it to training or to the RAG index usually holds broad credentials, and if it is compromised, everything downstream inherits the problem. The same applies to CI/CD systems that build and publish models.

How to secure the AI supply chain

The principle is the same as in traditional software: know what you use, where it comes from and what it can access.

• An inventory of models, datasets, dependencies and MCP servers with version, source and owner, usually called an SBOM or, for AI components, an AI BOM.
• Safe formats such as safetensors, which store only tensors, and refusal of pickle files from untrusted sources. If there is no alternative, load them in an isolated environment with no network or credentials.
• Model scanners that look for dangerous operations in serialized files, keeping in mind they do not catch everything.
• Pinned versions, verified hashes or signatures and an internal mirror of approved artifacts.
• Remote code execution on model load disabled by default.
• MCP servers reviewed before you connect them, with pinned versions, alerts when their tools change, sandboxed execution and minimal credentials.
• Evaluation of every model before deployment, with behavioral testing and red teaming.
• Pipelines with least privilege at each step, input data validation and provenance records.

Where to practise it on AI Labs

• FORGEChatbot · Medium · MCP agent
• DataPipe AnalyticsMachine · Hard
• KernelForgeMachine · Hard