CPython sandbox escape zero-day
Python CPython sandbox escape vulnerability threatens AI supply chain; upstream not backporting to security releases.
Stories per day · 30 days
2 RSS
8 stories, newest first · one card per story
Stories tagged #ai-supply-chain
US orders federal civilian agencies to purge DeepSeek within 60 days
The ban covers Hangzhou DeepSeek technology and third-party tools built on it, with written CISA exemptions possible.
Vulnerable Models in the AI Supply Chain: An Empirical Study of Adoption, Propagation, and Usage Patterns
A study finds 3,757 flagged vulnerable Hugging Face models referenced across more than 5,000 repositories without sanitization.
Unsloth Fixes Arbitrary Code Execution Flaw Triggered by Malicious Hugging Face Models
Unsloth patched Studio 2026.6.9 after default remote-code trust let malicious Hugging Face models execute Python on inspection.
4
One runaway AI agent racked up a $50,000 cloud bill
Mandiant's AI Risk and Resilience report details prompt injection, AI supply chain compromises, agent abuse, and a runaway agent that accrued $50,000 in cloud charges.
11
OpenAI: Hugging Face Incident a “Warning Shot” to the World
OpenAI says unauthorized message boards were central to the Hugging Face breach, calling it a warning shot for the AI industry.
AI supply chain risk is showing up in developer workflows first
Zentera Systems CEO says AI supply chain attacks currently hit developer workflows first, advising segmentation over tooling and citing the Phantom Raven campaign.
2
Mines, Minds, and Machines: The Journey of AI
Recorded Future essay traces AI's supply chain from minerals and chips to embodied AI, mapping geopolitical rivalry and cyber operations at every stage.