Supply Chain

120 reports

All LLM Security Agentic AI Industry News Research Supply Chain Prompt Injection First Look: Security Regulatory Jailbreaks Adversarial ML Data Poisoning Model Theft AI Security Tools Security Operations

GoModel AI Gateway Supply Chain Compromise

ATLAS OWASP MEDIUM ▲ 6.2 HN AI Security Apr 21, 2026

GoModel is an open-source AI gateway written in Go that provides a unified OpenAI-compatible API across multiple LLM providers including OpenAI, Anthropic, Gemini, Groq, xAI, and Ollama. As an infrastructure layer sitting between applications and AI backends, it introduces a significant supply chain and API security surface that warrants scrutiny. The project advertises built-in guardrails and observability, which are positive security signals, but open-source gateway projects centralising multi-provider API key management represent a meaningful attack vector if misconfigured or compromised.

CVE-2026: Anthropic MCP SDK Remote Code Execution

ATLAS OWASP CRITICAL ▲ 9.4 The Hacker News Apr 20, 2026

A systemic 'by design' vulnerability in Anthropic's Model Context Protocol (MCP) SDK enables arbitrary remote code execution across all supported language implementations via unsafe STDIO transport defaults, affecting over 7,000 publicly accessible servers and 150 million downloads. The flaw has been independently confirmed across 10+ popular AI frameworks including LiteLLM, LangChain, and Flowise, with Anthropic declining to modify the protocol's architecture. This represents a significant AI supply chain risk with cascading exposure to sensitive data, API keys, and internal systems.

Vercel Breach: Context.ai OAuth Token Hijack Exposes Credentials

ATLAS OWASP HIGH ▲ 7.5 The Hacker News Apr 20, 2026

Vercel suffered a breach originating from a compromised third-party AI tool, Context.ai, where an employee's OAuth token was hijacked to access Vercel's Google Workspace and internal environment variables. The incident highlights the systemic risk of granting broad OAuth permissions to AI productivity tools, particularly when employees use enterprise credentials with 'Allow All' permission scopes. ShinyHunters has claimed responsibility and is reportedly selling the stolen data for $2 million.

Axios npm Library Compromised in Supply Chain Attack

ATLAS OWASP HIGH ▲ 7.2 The Hacker News Apr 20, 2026

A North Korean threat group (UNC1069) compromised the popular npm Axios library via a supply chain attack, injecting a backdoor (WAVESHAPER.V2) into two poisoned versions that were inadvertently downloaded by OpenAI's macOS app-signing GitHub Actions workflow. Although OpenAI found no evidence of certificate exfiltration or user data compromise, the incident exposed the signing credentials for ChatGPT Desktop, Codex, Codex CLI, and Atlas, prompting certificate revocation and mandatory app updates by May 8, 2026. The attack highlights the acute risk of software supply chain compromises against AI product delivery pipelines.

Anthropic MCP Supply Chain Flaw Enables Command Injection

ATLAS OWASP CRITICAL ▲ 9.1 SecurityWeek Apr 16, 2026

A structural vulnerability in Anthropic's Model Context Protocol (MCP) allows unsanitized commands to be executed silently within AI environments, potentially enabling full system compromise. Researchers classify the flaw as 'by design,' meaning it stems from architectural decisions rather than implementation bugs, making it particularly difficult to patch without protocol-level changes. The breadth of MCP adoption across agentic AI toolchains significantly amplifies the supply chain risk.

Gas Town Supply Chain Attack Hijacks LLM Credits

ATLAS OWASP HIGH ▲ 8.5 HN AI Security Apr 16, 2026

Gas Town, a developer tool with 14.2k GitHub stars, allegedly ships configuration files that autonomously consume users' LLM API credits and GitHub account permissions to perform work on the maintainer's own repository — without explicit user consent. This represents a serious instance of unauthorised agentic AI behaviour, where an installed tool hijacks user-provisioned AI resources and credentials for third-party benefit. The incident raises critical concerns around supply chain trust, excessive agency in LLM-integrated tooling, and the abuse of delegated credentials.

Claude Code Source Leak Exposes 512K Lines of Code

ATLAS OWASP MEDIUM ▲ 6.2 HN AI Security Apr 16, 2026

A packaging error exposed 512,000 lines of Claude Code's source, revealing severe code quality issues including a 3,167-line monolithic function, undocumented API waste, and regex-based sentiment analysis in an LLM product — raising questions about the security posture of AI-generated codebases. The disclosure highlights systemic risks when AI systems are used to self-develop production tooling without adequate human review or architectural oversight. These patterns represent meaningful supply chain and excessive agency concerns for enterprise users of Claude Code.

OpenAI Supply Chain Attack via Axios Code Signing

ATLAS OWASP HIGH ▲ 7.5 SecurityWeek Apr 14, 2026

OpenAI has been impacted by a supply chain attack attributed to North Korea-linked threat actors, involving a compromised macOS code signing certificate associated with the Axios JavaScript library. The incident highlights the vulnerability of major AI platforms to upstream software supply chain compromises, which could expose users to malicious code distributed through trusted tooling. As a leading AI infrastructure provider, any compromise of OpenAI's build or distribution pipeline carries significant downstream risk for enterprises relying on its models and APIs.

litellm Supply Chain Attack: PyPI .pth File Injection

ATLAS OWASP HIGH ▲ 8.2 Schneier on Security Apr 13, 2026

A malicious supply chain attack was discovered in litellm version 1.82.8, a widely-used Python library that serves as a unified interface for interacting with large language model APIs. The compromised package contained a hidden .pth file executing arbitrary code on every Python interpreter startup, meaning any developer or AI system relying on litellm could be silently compromised without triggering an explicit import. Given litellm's central role in LLM-powered application stacks, this attack vector poses significant risk to AI pipeline integrity, credential theft, and downstream model infrastructure.

ComfyUI RCE Exploited in Cryptomining Botnet Campaign

ATLAS OWASP HIGH ▲ 7.2 The Hacker News Apr 13, 2026

Threat actors are actively exploiting internet-exposed ComfyUI instances — a popular AI image generation platform — by abusing its custom node execution feature to achieve unauthenticated remote code execution. Over 1,000 publicly accessible instances have been identified as targets, with compromised hosts enrolled in Monero and Conflux cryptomining operations and a Hysteria V2 proxy botnet. The attack highlights critical supply chain and insecure plugin design risks inherent in AI/ML tooling ecosystems.

CVE-2025-59528: Flowise RCE Exploited Across 12,000 Instances

ATLAS OWASP CRITICAL ▲ 9.4 The Hacker News Apr 13, 2026

A maximum-severity (CVSS 10.0) remote code execution vulnerability in Flowise, a widely-used open-source AI agent builder, is under active exploitation with over 12,000 internet-exposed instances at risk. The flaw, CVE-2025-59528, exists in the CustomMCP node and allows unauthenticated JavaScript execution with full Node.js runtime privileges via unsanitised MCP server configuration input. This marks the third Flowise vulnerability exploited in the wild, underscoring systemic security gaps in AI orchestration and agent-building platforms.

AI Browser Extensions 60% Riskier Than Standard Tools

ATLAS OWASP HIGH ▲ 7.5 The Hacker News Apr 10, 2026

A LayerX report reveals that AI browser extensions represent a largely unmonitored attack surface in enterprise environments, with 1-in-6 enterprise users already running at least one AI extension. These extensions are statistically riskier than standard extensions — 60% more likely to carry a CVE, 3x more likely to access cookies, and capable of exfiltrating sensitive data without triggering DLP or SaaS monitoring controls. The finding highlights a critical governance gap in AI consumption channels that bypasses traditional enterprise security tooling.

botctl Process Manager Enables Prompt Injection Attacks

ATLAS OWASP HIGH ▲ 7.2 HN AI Security Apr 09, 2026

botctl is an open-source process manager that enables persistent, autonomous AI agents (currently Claude-backed) to run continuously as background daemons with tool access, file system write permissions, and internet connectivity. While marketed as a productivity tool, the architecture introduces substantial attack surface through unattended agentic execution, a skills marketplace with third-party prompt injection, and a locally-exposed web dashboard. The combination of persistent autonomy, extensible skill modules from arbitrary GitHub repositories, and session memory creates compounding risk vectors relevant to agentic AI security.

GitHub Supply Chain Attacks via PRT-scan Campaign

ATLAS OWASP HIGH ▲ 7.5 Dark Reading Apr 06, 2026

A threat actor identified as part of the PRT-scan campaign has leveraged AI-assisted automation to systematically target a widespread GitHub misconfiguration, marking the second such campaign in recent months. The use of AI for automated reconnaissance and exploitation of supply chain vulnerabilities represents a significant escalation in attacker capability. This campaign highlights the growing risk of AI-augmented attacks against software supply chains, which can have cascading downstream effects on ML pipelines and production systems.

Claude Source Code Leak Reveals AI Supply Chain Risk

ATLAS OWASP HIGH ▲ 8.2 Dark Reading Apr 03, 2026

A reported source code leak affecting Claude, Anthropic's large language model, underscores systemic weaknesses in AI software supply chains and the absence of robust oversight mechanisms at critical development and distribution layers. The incident highlights how proprietary model code, training pipelines, and system prompts can become high-value targets for adversarial actors seeking to enable model theft, backdoor insertion, or competitive intelligence gathering. This event serves as a broader warning about treating AI development infrastructure with the same rigor applied to other critical systems.

Supply Chain

Stay ahead of the threat.