A weights file from Hugging Face is not a CSV. When torch.load() deserializes it, it executes arbitrary Python — by design, not by accident. The model named "baller423" that opened a reverse shell to a Korean research network during load looked, scanned, and ran like every other model in the repository. That single fact reframes the entire AI supply chain: when a data scientist pulls a model into a notebook, the enterprise perimeter has just hired a new executable. Yet the average AI program still treats model artifacts the way it treats datasets — versioned, mirrored, occasionally scanned, almost never signed. We built AI Supply Chain Security & Model Integrity at Veriprajna because the gap between how models are loaded and how CISOs are defending them is now where most AI breaches will originate in 2026.
The IBM 2025 Cost of a Data Breach Report put the average shadow-AI breach at $4.63M, roughly $670K higher than a comparable incident without an AI vector. Kiteworks' 2025 benchmark found that 83% of organizations operate without automated AI security controls. Those two numbers describe the same picture from opposite ends — the cost is rising and the controls are absent. The point-scan tools dominating the market do real work at the scanning layer: JFrog's MLSecOps module, Wiz's AI-BOM features, and the Protect AI engine that Palo Alto Networks acquired in July 2025 for roughly $500–700M and folded into Prisma AIRS all catch the easy class of malicious artifact. None of them redesign the pipeline around the fact that a model is code.
The Scanner Is Part of the Attack Surface
The first thing we learned auditing model registries for enterprise clients is that the scanners themselves get attacked. PickleScan, the de-facto open-source tool most teams rely on, has shipped with three publicly disclosed bypasses including CVE-2025-10155 and four additional CVEs that Sonatype filed against picklescan itself before v0.0.23. HiddenLayer's "Silent Sabotage" research showed that Hugging Face's own SafeTensors conversion service could be coerced into running attacker-controlled code as a privileged user. When a CISO presents to the board that "we scan every model before it lands in our registry," that sentence is only meaningful if the team has interrogated the threat model of the scanner itself — which almost no team has done.
Protect AI's research arm scanned 4.47 million model versions across public registries and surfaced 352,000 unsafe or suspicious issues across 51,700 distinct models. JFrog's 2024 Hugging Face audit found over 100 explicitly malicious models. The conclusion isn't "stop using Hugging Face" — it's that scanning catches the easy class and the marketing claim of "model security" is being asked to do the work that signed provenance is supposed to do. CycloneDX 1.6 ML-BOM and the Coalition for Secure AI (CoSAI) claimant-model signing standard exist precisely for this gap. Enterprise adoption sits in the low single digits.
Adversarial Defense Is the Same Attack Surface Viewed Sideways
The vendors who sell model scanning and the vendors who sell adversarial-ML defense tend to be sold to different teams, but they are defending the same artifact. NIST's updated AI 100-2 (E2025) taxonomy, published in March 2025, finally folded evasion, poisoning, privacy, and misuse attacks for both predictive and generative models into one framework. The reason matters: a backdoored model planted by a supply chain attack and a backdoored model planted by training-data poisoning have nearly identical runtime behavior. The defenses converge whether the security team has organized that way or not.
250 poisoned documents — about 0.00016% of the training corpus — are enough to implant a working backdoor in a 13-billion-parameter model.
That figure, from joint Anthropic and NVIDIA research, is the one most enterprise threat models are unprepared for. The implicit assumption baked into most AI security programs is that attackers need to corrupt a significant fraction of the training set. They do not. Microsoft's February 2026 paper on "Double Triangle" attention patterns offered the first general-purpose method to detect poisoned models without knowing the trigger phrase — a real breakthrough, but one that requires runtime introspection capability that virtually no enterprise has built. The engineering work to operationalize that paper today sits with the buyer.
Fine-Tuning Quietly Removes the Safety Floor
The most overlooked vector in production deployments is not external poisoning at all. It is fine-tuning, which almost every enterprise now does and almost no enterprise re-evaluates against. The published measurement (arXiv:2503.09334) is striking: Llama 3.1 8B's resistance to prompt-injection attacks drops from 0.95 to 0.15 after standard fine-tuning. The safety alignment that the model card advertises is, in operational terms, gone — and the production model serving the customer-support workflow has a small fraction of the resilience the procurement deck claimed it had.
This finding should rewrite the post-fine-tune QA checklist at every regulated enterprise. In our consulting engagements it almost never has. A model leaves fine-tuning, passes accuracy benchmarks, ships to production, and the safety evaluation is the same one that ran on the base model six months earlier. The mechanical fix is to pick a published prompt-injection benchmark and run it as a CI/CD gate before any fine-tuned weight is promoted — but the discipline doesn't exist as a default in any of the major MLOps platforms.
The Wrapper Layer Is Where Agents Compromise You
The 2026 inflection isn't supply chain attacks on weights — it is the agentic layer that wraps the model. GitHub's CVE-2025-53773 (CVSS 7.8) showed how a prompt injection chained through Copilot's "YOLO mode" achieved full system compromise on the developer's machine. Amazon Q's July 2025 incident — a malicious cleaner.md prompt template introduced through a misconfigured GitHub token — shipped destructive shell commands inside version 1.84.0 to every user who auto-updated. OpenClaw, the open-source agent framework with 346,000 GitHub stars and 135,000+ exposed instances, accumulated 138 CVEs in 63 days during its first major security crisis; 12% of its public marketplace skills were found to be malicious.
HiddenLayer's 2026 AI Threat Landscape Report attributes one in eight AI breaches to agentic systems. The reason is structural. A coding or research agent doesn't emit one output that a human reviews. It chains tool calls, file writes, and shell invocations across a session, and the model's output at step N is the model's input at step N+1. A single prompt injection that smuggles in a git push --force becomes a real git push --force. The traditional content-moderation pipeline — input filter, model call, output filter — assumes the dangerous content is in the response. In agentic systems it is increasingly in the chain of tool calls between responses.
This is why the Veriprajna page treats wrapper security as part of the same CISO surface as supply chain integrity: the team that has to defend the model registry is now the team that has to defend the agent runtime. The security architecture for that runtime — sandboxing, capability tokens, per-tool authorization scopes, attestation of the agent loop itself — has not yet shipped from the vendor side as a product.
What a CISO Can Actually Ship in the Next Two Quarters
A 200-page "AI security strategy" of the kind a Big-Four firm will produce for $500K is not a control. The architecture that earns its budget under the EU AI Act — fully applicable August 2, 2026, with General-Purpose AI Model obligations live since August 2025 — is a sequence of shipped components, not a framework.
Start at intake. Every external model gets unpickled in an isolated sandbox before signing, scanned against the NIST AI 100-2 taxonomy, fingerprinted, and added to the ML-BOM with full provenance. The signing chain is short, auditable, and the inclusion proof — a Sigstore Rekor entry, in our typical reference — is visible from the model card forward. From there, the second piece of work is at the network edge: the 62% of practitioners who cannot enumerate where their LLMs run will not find them by asking the workforce, so the discovery has to be passive, sitting in the MDM and proxy logs that already exist.
The Llama 3.1 numbers above mean that a post-fine-tune adversarial-robustness gate has to live in the same CI/CD pipeline that approves the weights for promotion — a step that should be mechanical and almost never is. For the highest-risk workloads, confidential inference on the NVIDIA Hopper or Blackwell TEEs that Fortanix's March 2026 product made enterprise-deployable closes the loop on where the data actually decrypts. None of these components are research. They are implementations that exist as published standards and shipping tools today, that 83% of enterprises have not put together into a defended pipeline. The work between the published standard and the production system is the work that matters, and it is engineering work, not advisory work.
The Budget Conversation Has Already Shifted
The Wiz CISO Budget Benchmark for 2026 found that 85% of organizations have increased cybersecurity budgets and roughly 90% expect AI-related security spending to rise. The constructive reframe — for boards, not for the security team — is that AI security spend should not be carved out of the security budget alone. It belongs embedded inside the enterprise AI investment, because the breach risk is generated by the deployment, not by the defense. A CISO who can present a risk delta tied to each AI investment line item gets a different reception than one who shows up with an incremental security ask after the fact.
The CISOs we work with ask a version of one question: which of the controls listed above will measurably reduce our incident probability in the next eighteen months, in the order our budget can support? That is a different conversation than "build us an AI governance program," and it is the conversation the page at veriprajna.com/solutions/ai-supply-chain-security is designed to start.
If your team is working on the model-signing or shadow-AI side of this and arriving at architectural choices that don't match what the vendor briefings suggest, that is the conversation we would most want to compare notes on. The standards are settled. The deployment patterns are not, and we do not think any single firm has the final answer yet on what production AI security looks like at scale.