supply chain

The tools are free; running them is not. A strong answer picks a small set by risk, assigns owners, and treats every security tool as software that can be compromised or relicensed.

A small root hash that commits to millions of entries. The scored answer builds an inclusion proof, explains consistency proofs, and names the systems that depend on them.

The format is the bug. JSON cannot call functions; pickle is designed to. The AI version is the model checkpoint you just downloaded.

Generated code ships faster, which is the point and the risk. The scored answer names the specific failure modes and keeps the normal controls working at the new speed.

An extension with 'read and change all your data on all websites' sits inside every session your staff open, and it updates itself. The scored answer treats extensions like software you deploy, because they are.

A customer model is customer code: loading it can execute anything, and serving it shares expensive hardware. The scored answer isolates execution, scans and constrains artefacts, and keeps tenants apart on GPUs and networks.

Serving images bundle a model runtime, GPU libraries and dozens of Python packages. The scored answer controls what goes in, proves where it came from, and admits only verified images to production.

Weights pass through more systems than most teams draw. The scored answer maps every hop, asks what an attacker could steal or swap at each, and puts integrity checks where they cannot be skipped.

Serving nodes parse hostile input all day, so assume one falls. The design question is what it can reach: the registry, other tenants' models, the signing keys, or nothing at all.

The mechanism takes a minute. The score comes from saying exactly what a valid signature does not prove, and running the key-theft response.

Half the answer is 'pickle runs code'. The half that scores is everything safetensors leaves open.

Models arrive like dependencies and run like code. The design puts one controlled door in front of them and checks everything that walks through.

'Keyless' means no long-lived key, not no keys. The follow-up that separates candidates: what does your verification policy actually check?

An SBOM lists libraries. An AI-BOM has to answer a harder question: which base model and which data is this behaviour descended from?

Three ways a package you never meant to run ends up in your build. AI coding assistants added a fourth: the package that never existed until someone registered it.

A model is a directory, not a file. Sign the whole thing, tie the signature to the pipeline that produced it, and refuse to load anything that does not match.

Provenance is only worth anything at the moment someone refuses to deploy because it does not match. Say where that moment is.

The package ran with everything the training job could reach: data, credentials, checkpoints. Scope by what it could touch, not by what you hope it did.

The weights are safetensors and the code is a Python file from the same repository, fetched at load time. Guess which one runs with your credentials.

The pipeline holds the keys to production and runs code from pull requests. The scored answer separates untrusted from privileged work, pins what it executes, and removes long-lived secrets.

An MCP server is code you run or trust, plus text your model reads. The scored answer reviews who wrote it, what it can reach, what its tool descriptions say, and pins it so it cannot change silently.

Supply chain risk spans what you consume, how you build and what you ship. The scored answer sequences the work by risk reduced per effort and covers models and datasets as dependencies too.

Typosquatting waits for a human typo. Slopsquatting waits for a model to invent the same wrong name again, and models repeat themselves.

Shai-Hulud showed that a stolen publishing token can turn one compromised maintainer into hundreds of poisoned packages within hours. The response is part incident handling, part credential hygiene, and the prevention lives in your CI.

CI already mixed untrusted input with powerful tokens. Adding an agent that reads issue text and can act turns a shell-injection problem into a prompt-injection problem. The scored answer fixes both.

Neither option is simply safer. The answer that scores names who you are trusting in each case and which controls move from the provider to you.

Review an integration by tracing model input, process access and credential recipients. Then name the component that refuses each unauthorized action.

Distinguish metadata review from runtime authorization. Work through an uncalled tool, a changed definition and a server whose behavior changes without new metadata.

Repository instructions can influence a model; configuration can change execution. Trace creation, replacement and startup before deciding where approval must hold.

A skill is instructions plus code that runs with the agent's own permissions, with no process boundary in between. The scored answer reviews it like software and like a prompt, because it is both.

The model passes your evaluation because your evaluation does not contain the trigger. And safety training may teach it to hide better.

The intuition that a huge dataset dilutes poison turns out to be wrong for some attacks. The scored answer cites the evidence, explains why, and moves the defence to data provenance and testing.