The race to secure the AI/ML supply chain is on — get out front

The report highlights accelerating AI/ML software supply chain risks, noting ReversingLabs’ discovery of malicious Pickle-based ML models on Hugging Face that evaded scanning and ongoing abuses in OSS ecosystems like npm and PyPI. It underscores inherent dangers of Pickle deserialization, the growing attack surface introduced by AI coding tools, and emerging OWASP guidance (LLM Top 10, CycloneDX v1.6, LLM Security and Governance Checklist). The piece urges enterprises to adopt stronger AppSec practices and tooling—such as binary analysis and reproducible builds—to detect unsafe behaviors in ML artifacts and manage AI-driven supply chain risk.