Supply chain attacks, ranging from a compromised model to a poisoned vector store, bypass runtime defenses because the threat is present before input validation runs, yet provenance is the surface most directly controllable and the attack source spanning all stages.

The article frames the supply chain as a surface that bypasses runtime defenses, citing the nullifAI pickle-file backdoor that evaded Hugging Face's scanner and Protect AI flagging ~352,000 of 4M models, while noting model selection is a controllable provenance factor. ✦ AI generated

Article author (GLM pipeline) · ByteByteGo Newsletter · 2026-08-03 · original ↗

Every model, adapter, vector store, and tool in a stack originates from a supplier, and any of them can arrive compromised. This is the supply chain surface, and it bypasses runtime defenses because the threat is present before input validation runs. In early 2025, ReversingLabs documented a technique named nullifAI, in which malicious models uploaded to Hugging Face concealed a reverse shell ... inside a Python pickle file. The file was compressed in a manner that evaded Picklescan ... Protect AI ... has examined more than four million and flagged roughly 352,000 as carrying unsafe or suspicious issues. Provenance is one of the few fully controllable factors.

Read full article ↗excerpt · fair-use quotation