The Next Web

The AI industry’s model and agent skill repositories are full of malware. The infrastructure built to accelerate development is now the vector for compromising it.

Hugging Face hosts 352,000 unsafe model issues. ClawHub's registry contains 341 malicious AI agent skills. The AI supply chain is now the most attractive target in software security.
Bleeping Computer

Ultralytics AI model hijacked to infect thousands with cryptominer

The popular Ultralytics YOLO11 AI model was compromised in a supply chain attack to deploy cryptominers on devices running versions 8.3.41 and 8.3.42 from the Python Package Index (PyPI) Ultralytics ...
InfoWorld

Malicious Hugging Face model masquerading as OpenAI release hits 244K downloads

The repository reached the #1 trending position on Hugging Face within 18 hours, highlighting how public AI repositories are ...
Forbes

Model Supply Chain Poisoning: Threats And Mitigation Strategies

Syed Quiser Ahmed is AVP, Global Head of Responsible AI at Infosys, a global leader in next-generation digital services and consulting. Between December 25 and 30, 2022, we ran pip install torchtriton ...
Dark Reading

W4SP Stealer Stings Python Developers in Supply Chain Attack

Attackers continue to create fake Python packages and use rudimentary obfuscation techniques in an attempt to infect developers' systems with the W4SP Stealer, a Trojan designed to steal ...
Supply Chain

The Supply Chain Control Tower Maturity Model

Analyst Insight: Enabling supply chain visibility via control tower technology and capabilities remains one of the most sought-after supply chain initiatives for many organizations. However, many ...