The AI supply chain has become one of the most actively exploited attack surfaces in modern cybersecurity. From poisoned models on Hugging Face to malicious packages targeting PyTorch and TensorFlow ecosystems, threat actors are systematically compromising the foundational infrastructure that enterprises use to build, train, and deploy AI systems.
PoisonGPT: The Blueprint for Model Supply Chain Compromise
Researchers at Mithril Security demonstrated the core attack with PoisonGPT: they surgically modified the open-source GPT-J-6B model to spread targeted misinformation on specific topics while maintaining normal performance on all standard benchmarks. The poisoned model was uploaded to Hugging Face under a near-identical namespace ("EleuterAI" — missing the 'h' from the original "EleutherAI") and could have been consumed by any downstream application pulling models by name. OWASP now cites PoisonGPT as a canonical example of LLM supply chain risk in its 2025 Top 10.
Namespace Reuse: A New Attack Vector
Unit 42 (Palo Alto Networks) disclosed a more sophisticated technique in September 2025: Model Namespace Reuse. When a Hugging Face user or organization deletes their account, their namespace becomes available for re-registration. Researchers demonstrated that by re-creating an abandoned namespace and uploading a backdoored model, they could compromise any deployment pipeline that referenced the original model by name — including Google Vertex AI, where they achieved reverse shell access to the endpoint environment hosting the model.
The NullBulge Campaign and Malicious Packages
Threat actor NullBulge conducted active supply chain attacks throughout 2024–2025, weaponizing code in Hugging Face and GitHub repositories. As documented by SentinelOne, the group compromised the ComfyUI_LLMVISION extension and distributed Python-based payloads that exfiltrated data via Discord webhooks and delivered customized LockBit ransomware. Separately, ReversingLabs found malware hidden in AI models on Hugging Face and trojanized packages on PyPI posing as SDKs for Alibaba Cloud's AI services — both exploiting the Pickle serialization format commonly used for PyTorch models.
Sonatype's Open Source Malware Index for Q1 2025 uncovered over 18,000 malicious open-source packages, many specifically targeting AI ecosystems. OWASP's LLM03:2025 Supply Chain entry now mandates model provenance verification, SBOM generation for ML assets, and sandboxed loading of all third-party models.