In the rush to build AI apps, please, please don't leave security behind

The article warns that AI development supply chains are at risk: malicious or poisoned models, unsafe deserialization formats (Pickle), and insecure conversion services can execute arbitrary code, exfiltrate Hugging Face tokens, and introduce backdoors into repositories; researchers (HiddenLayer, JFrog) found vulnerable conversion tooling and hundreds of malicious models, highlighting the need for supply-chain defenses, code auditing, and secure development practices.