The first time my team ran the "baller423" model from Hugging Face inside an isolated sandbox, I watched torch.load() open a TCP connection to a research network in Korea before the print statement we had added even fired. The model had cleared the commercial scanners we had run it through. It looked normal in the registry. The reverse shell was in the pickle file — running, by design, as the deserialization itself. That afternoon I stopped describing what we built at Veriprajna as "AI supply chain security" and started calling it what it actually is: model-integrity engineering for code that masquerades as data. The shift in language mattered, because every CISO I had been talking to up to that point was treating model artifacts like CSV files with extra metadata.
The numbers around this are not theoretical. The IBM 2025 Cost of a Data Breach Report put shadow-AI breach cost at $4.63M, roughly $670K higher than a comparable incident. Kiteworks' 2025 benchmark put the share of organizations operating without automated AI security controls at 83%. Protect AI — now inside Palo Alto Networks after the July 2025 acquisition that closed at roughly $500–700M — scanned 4.47M model versions and surfaced 352,000 unsafe issues across 51,700 distinct models. JFrog's earlier Hugging Face audit found over 100 explicitly malicious models. None of those numbers were the thing that changed how I write our intake architecture. The reverse-shell-on-load was.
The Conversation That Put a Number on the Gap
A few weeks after the baller423 sandbox session, I was on a call with a CISO at a regulated enterprise — one of the cases I now use anonymously when talking to other security buyers. He said, with the practiced confidence of a board presentation, that his team scanned every model before it landed in the production registry. I asked whether anyone on his team had read the picklescan CVE list recently. He had not. Nobody on his team had. The scanner they relied on — the de-facto open-source default — had shipped with three publicly disclosed bypasses including CVE-2025-10155 and four additional CVEs that Sonatype filed against picklescan itself before v0.0.23. HiddenLayer's "Silent Sabotage" research had already shown the Hugging Face SafeTensors conversion service could be coerced into running attacker code as a privileged user.
The gap between "we scan" as board language and "we scan" as engineering practice was the entire engagement. The marketing claim of "model security" was being asked to do the work that signed provenance is supposed to do. CycloneDX 1.6 ML-BOM and the Coalition for Secure AI claimant-model signing standard exist precisely for this. Enterprise adoption sits in the low single digits because, as that CISO put it to me later in paraphrase, his procurement team had been told the scanning vendor already covered it.
What I Learned the Week I Read the picklescan CVE Trail
I read the picklescan write-ups in sequence on a Tuesday and rewrote the intake section of our reference architecture by Friday. The lesson was not that picklescan is bad — it is a useful piece of open source — it was that the scanner is part of the attack surface, and we had been treating it as a control rather than as an artifact that itself needs threat modeling. The same week I went back to earlier client engagements and quietly added a line item to the next-quarter roadmap: an independent dynamic-analysis pass on every model the static scanner clears, run in an isolated namespace with no outbound network, before the signing key touches it.
NIST's updated AI 100-2 (E2025) taxonomy, published in March 2025, finally pulled evasion, poisoning, privacy, and misuse attacks for both predictive and generative models into one framework. That mattered to my client conversations because the security teams I work with had been organizationally split — model scanning was AppSec, adversarial defense was AI/ML, prompt injection was Trust & Safety. The defenses converge whether the org chart has caught up or not, and the NIST taxonomy gave me a single document I could put in front of three teams at once.
The Anthropic-NVIDIA Number That Rewrote Our Threat Model
250 poisoned documents — 0.00016% of the training corpus — are enough to implant a working backdoor in a 13-billion-parameter model.
I read that joint Anthropic and NVIDIA result on a flight and spent the rest of the cabin time rewriting the threat-model section of our briefing deck. The implicit assumption nearly every CISO I had talked to was carrying — that attackers need to corrupt a meaningful fraction of training data — was wrong by four orders of magnitude. Microsoft's February 2026 "Double Triangle" attention-pattern paper became the only general-purpose method we knew of to detect a poisoned model without first knowing the trigger phrase, which is the one variable the attacker controls. The week that paper landed, I sat with the intake checklist we had been using and realized every step in it had assumed the defender knew what to look for.
Operationalizing the Microsoft work today requires runtime introspection capability that almost no enterprise has built. The engineering between the paper and the production gate is, again, the buyer's problem.
The Llama 3.1 Result I Now Open Client Meetings With
The published measurement from arXiv:2503.09334 is the slide I now lead with when I sit down with a CISO whose team is deploying fine-tuned models: Llama 3.1 8B's resistance to prompt injection drops from 0.95 to 0.15 after standard fine-tuning. The safety alignment that ships on the model card is, in operational terms, gone. The model serving the customer-support workflow has a small fraction of the resilience the procurement deck claimed.
Every recent client engagement I have started has uncovered the same pattern: the post-fine-tune evaluation is the same evaluation that ran on the base model six months earlier. The accuracy benchmarks pass. The safety eval is not re-run. The mechanical fix is to pick a published prompt-injection benchmark, wire it into the CI/CD step that promotes a fine-tuned weight, and fail the build if the score moves more than a defined delta — and not a single major MLOps platform ships this as a default. That gap is where the work lives.
When I Started Treating the Agent Runtime as a Separate Product
The 2026 inflection for me was not supply chain attacks on weights. It was the agentic wrapper. GitHub's CVE-2025-53773 — CVSS 7.8, a Copilot prompt injection chained through "YOLO mode" into full system compromise on the developer's machine — was the first incident I forwarded internally with the subject line "this changes the threat model." Weeks later, Amazon Q's July 2025 incident shipped destructive shell commands inside version 1.84.0, introduced through a malicious cleaner.md prompt template injected via a misconfigured GitHub token. OpenClaw, the open-source agent framework that crossed 346,000 GitHub stars and 135,000+ exposed instances, accumulated 138 CVEs in 63 days during its first major security crisis; 12% of its public marketplace skills were found to be malicious.
HiddenLayer's 2026 AI Threat Landscape Report now attributes one in eight AI breaches to agentic systems. The reason is structural. A coding or research agent chains tool calls, file writes, and shell invocations across a session, and the model's output at step N is the model's input at step N+1. A prompt injection that smuggles in a git push --force becomes a real git push --force. The traditional input-filter / model-call / output-filter pipeline assumed the dangerous content was in the response. In agentic systems it is increasingly in the chain of tool calls between responses. I started insisting in client engagements that the agent runtime gets its own threat model, its own attestation, and its own capability-scoped sandbox — because nothing the model-scanning vendors ship today addresses the wrapper layer.
What I Tell CISOs to Ship in the Next Two Quarters
I have stopped delivering "AI security strategy" decks. A 200-page framework of the kind a Big-Four firm produces for $500K is not a control. The architecture I now hand a CISO who is preparing for the EU AI Act — fully applicable August 2, 2026, with General-Purpose AI Model obligations live since August 2025 — is a sequence of shipped components, in budget-defensible order.
The first thing I get into production is the intake pipeline: every external model unpickled in an isolated sandbox, scanned against the NIST AI 100-2 taxonomy, fingerprinted, and added to the ML-BOM with full provenance, with the inclusion proof — a Sigstore Rekor entry, in our typical reference architecture — visible from the model card forward. Next I push into the network layer, because the 62% of practitioners who cannot enumerate where their LLMs run are not going to find them by asking the workforce — the discovery has to be passive, sitting in the MDM and proxy logs that already exist. The Llama numbers above are why I now insist a post-fine-tune adversarial-robustness gate live in the same CI/CD pipeline that approves the weights. And for the highest-risk workloads, confidential inference on the NVIDIA Hopper or Blackwell TEEs that Fortanix's March 2026 product made enterprise-deployable is what closes the loop on where the data actually decrypts.
These are not research items. They are implementations that exist as published standards and shipping tools, that 83% of enterprises have not put together into a defended pipeline. The work between the published standard and the production system is engineering work, not advisory work.
The Question I Now Get From Every CISO
The question I now get at the end of almost every CISO conversation is downstream of a budget shift the Wiz CISO Budget Benchmark made visible for 2026 — 85% of organizations have increased cybersecurity budgets and roughly 90% expect AI-related security spending to rise. The reframe I push for in board conversations is that AI security spend should not be carved out of the security budget alone. It belongs embedded inside the enterprise AI investment, because the breach risk is generated by the deployment, not by the defense.
The version of the question I hear most often is: which of these controls will measurably reduce our incident probability in the next eighteen months, in the order our budget can support? The page at veriprajna.com/solutions/ai-supply-chain-security is the starting frame for that conversation.
The honest thing I tell them — and the thing I will close on here — is that I do not think any single firm has the final answer yet on what production AI security looks like at scale. The standards are settled. The deployment patterns are not. The CISOs I learn the most from are the ones who came back to me three months after we shipped the first piece of architecture and said the second piece had to be different from what we had planned, because something in their environment had moved. That feedback loop, more than any deck I have written, is what I now treat as the source.