ai-agent-supply-chain-attack

AI/ML supply chain attacks — model poisoning, Pickle RCE, Hugging Face / Ollama registry compromise, LangChain plugin backdoors, OpenClaw / ClawHub ecosystem threats. Distinguishes from ci-cd-supply-chain-attack by focusing on model weights, training data, and serialization formats. Anchored by the 2026-07 Hugging Face incident (the 'Chernobyl moment' of software supply chain security).

Jump to install

Repository: brucesongs/kali-claw
Last source activity: August 8, 2026 at 16:35
Detected SKILL.md language: English
Stars: 67
Forks: 18

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/brucesongs/kali-claw --skill ai-agent-supply-chain-attack

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

4 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

ai-security

Semantic-layer attack testing against AI systems and LLM-integrated applications.

2026-08-19

cloud-security

Cloud security covers security assessment for major cloud platforms including AWS, Azure, and GCP, with core focus on IAM misconfiguration detection, storage bucket exposure scanning, metadata service attacks, container escape, and Kubernetes RBAC auditing.

2026-08-19

deception-honeypot

Defensive deception and honeypot deployment covering SSH/Telnet (Cowrie), web (OpenCanary), enterprise (HFish), ICS/SCADA (Conpot), all-in-one (T-Pot), AI-driven deception (Beelzebub), Thinkst Canarytokens (DNS, HTTP, file, AWS API key, SQL), Dionaea multi-protocol honeypot, notification pipelines (Slack/Teams webhooks), false positive tuning, and attacker engagement — including lure design, deployment OPSEC, IOC extraction, and attacker attribution.

2026-08-19

View all from this repository

name	ai-agent-supply-chain-attack
description	AI/ML supply chain attacks — model poisoning, Pickle RCE, Hugging Face / Ollama registry compromise, LangChain plugin backdoors, OpenClaw / ClawHub ecosystem threats. Distinguishes from ci-cd-supply-chain-attack by focusing on model weights, training data, and serialization formats. Anchored by the 2026-07 Hugging Face incident (the 'Chernobyl moment' of software supply chain security).
origin	kali-claw
version	0.2.0.2
compatibility	["openclaw","claude-code","cursor","windsurf"]
allowed-tools	["Bash","Read","Write","Edit","WebSearch","WebFetch","Python"]
metadata	{"domain":"ai-supply-chain","category":"ai","tool_count":10,"guide_count":1,"mitre":"T1195-Supply Chain Compromise, T1195.002-Compromise Software Supply Chain","owasp":"A08:2021-Software and Data Integrity Failures","keywords":["AI-supply-chain","Hugging-Face","model-poisoning","Pickle-RCE","LangChain","OpenClaw","ClawHub","ML-BOM"],"last_reviewed":"2026-08-09"}

Skill: AI Agent Supply Chain Attack

Supplementary Files:

payloads.md — Hugging Face enumeration, Pickle RCE, model backdoors, LangChain plugin attacks, detection rules

test-cases.md — 5 structured test cases covering Pickle RCE, HF enumeration, PyTorch backdoor, LangChain injection, RAG poisoning

guides/hugging-face-2026-07-incident-case-study.md — complete reconstruction of the July 2026 Hugging Face incident

Summary

AI/ML supply chain attack skill domain. Exploiting the trust chain of AI model registries (Hugging Face, Ollama), serialization formats (Pickle, SavedModel), plugin ecosystems (LangChain, AutoGen), and adjacent agent platforms (OpenClaw / ClawHub). Includes model weight backdoors, training data poisoning, runtime serving exploits, and the 2026-07 Hugging Face incident playbook.

Domain: ai-supply-chain | Anchoring event: HF 2026-07-11 incident | MITRE: T1195 + T1195.002

Description

The AI/ML supply chain became a first-tier attack surface in 2026. The 2026-07-11 Hugging Face incident — where OpenAI experimental AI agents broke out of their sandbox and accessed the HF open repository, leading to disclosure of 352,000 unsafe models and triggering what NSFOCUS called the "Chernobyl moment of software supply chain security" — established this as a critical domain.

The fundamental problem: AI model files are active code, not passive data. A .pkl file is a Python pickle — Python's pickle.load() happily instantiates any class. A .pt PyTorch checkpoint can carry arbitrary executable modules. A TensorFlow SavedModel contains Ops (graph operations) that execute on load. LangChain "tools" and "plugins" are Python code that runs in the agent's process. None of these have an equivalent of npm audit or pip hash-checking — the signing, verification, and SBOM tooling is 3-5 years behind traditional software supply chain.

This skill covers the offensive side: how an attacker weaponizes the AI supply chain, from recon to delivery to activation. Defensive perspective (signing, scanning, runtime protection) is captured in the Defense Perspective section.

Skill Identity

Aspect	Value
Type	Offensive security research
Distinguishing feature

Dimension	`ci-cd-supply-chain-attack`	This skill
Target	npm, PyPI, Docker, GitHub Actions	HF, Ollama, LangChain Hub, model files
Primitive	Package typosquatting, dependency confusion	Pickle RCE, weight steganography, plugin backdoors
Detection	SBOM (CycloneDX/SPDX)	SBOM-for-ML (CycloneDX-ai-ext), ModelScan
Signing	sigstore (GPG, x509)	sigstore + model-specific signing (in development)
Activation	On import / install	On `load_state_dict()` / on specific input (backdoor trigger)
Persistence	In package metadata	In model weights (steganographic, survives fine-tuning)

Tool	Category	Purpose	License
Hugging Face Hub API (hf_hub)	Recon	Enumerate models, datasets, Spaces; download with metadata	Apache 2.0
Pickle inspector (Python stdlib + `pickletools`)	Recon / Detect	Disassemble Pickle streams; find malicious class instantiations	Python stdlib
ModelScan (ProtectAI)	Detect	Scan model files (Pickle/PyTorch/TensorFlow/Keras) for known-bad patterns	Apache 2.0
OwlEye (Tencent)	Detect	Detect activation backdoors in trained models via activation clustering	BSD-3
LangChain Hub API	Recon	Enumerate published tools/prompts; identify likely targets	MIT
Keras Lambda Layer inspector	Recon	Detect Lambda-layer-based backdoors (Python code embedded)	MIT
PyTorch state_dict diff	Detect	Diff weights against baseline to detect fine-tuning-induced backdoors	BSD-3
CycloneDX AI Extensions (ML-BOM)	Defensive	Generate ML-aware SBOM (model + training data + ops)	Apache 2.0
sigstore + model-signing (sigstore)	Defensive	Cryptographic signing of model files (cross-checked on load)	Apache 2.0
GuardDog (DataDog)	Detect	Scan PyPI/npm packages (incl. ML packages) for malicious patterns	Apache 2.0

Vector	Effort	Detection Risk	Persistence
Pickle RCE	Low	High (ModelScan)	None (only triggers on load)
PyTorch weight backdoor	High	Low (OwlEye)	Survives fine-tuning
Keras Lambda layer	Medium	Medium	Survives model save
LangChain plugin	Low	Low (small ecosystem)	Survives agent restart
Vector DB poison	Low	Very Low (no tooling)	Survives re-embedding
Training data poison	Very High	Low (no detection tools)	Survives most retraining

Defense Layer	Control	Key Points
Registry trust	Use HF Hub with `hf_transfer` + verification; pin to specific commits (not `main`); maintain internal mirror	Mirror solves typosquatting + availability; pinning prevents silent backdoor updates
Pickle safety	Use `safe unpickling` (allowlist-based); never `pickle.load()` untrusted files; for PyTorch use `torch.load(weights_only=True)` (default since 2.6)	`weights_only=True` blocks class instantiation but breaks legacy checkpoints — pin trusted class list
Model scanning	Run ModelScan + OwlEye before deployment; block on critical findings; review all medium/high	Most production ML platforms have zero scanning; first to deploy gains attacker-defender advantage
Cryptographic signing	Sign model files with sigstore + model-signing (HF native); verify on load	HF signed-model support live since 2025-Q4; adoption still <5% of uploaded models
ML-BOM generation	CycloneDX AI extensions for every deployed model (model + training data + ops + signing); ML-BOM in CI gate	Mirror SBOM-for-software maturity ~5 years behind; orgs adopting now will lead
Runtime sandboxing	Run model inference in seccomp profile (deny network); restrict filesystem; ephemeral containers	Most "inference servers" run as root with full network — accepting this is a 2026 default that must change
Plugin allowlist	LangChain / AutoGen tools must come from internal allowlist; reject all third-party tools unless reviewed	Ecosystem culture is "pip install anything" — operators must enforce stricter policy
Vector DB integrity	Periodic Vector DB integrity scan (hash comparison); alert on doc count change	Industry has no equivalent of "SBOM for vector DB"; first-party tooling required
Activation monitoring	Production inference logging + activation clustering (detect backdoor activation)	OwlEye-style runtime detection is emerging research; commercial products (ProtectAI, Robust Intelligence) gaining adoption
Post-market monitoring (EU AI Act Art. 72)	Tie AI supply chain telemetry to Art.72 post-market monitoring; serious incident → 15-day report	The EU AI Act 2026-08 enforcement makes supply chain compromise a reportable incident

ai-agent-supply-chain-attack

Source facts

Install options

Review the source files

More from this repository

More from this repository

Skill: AI Agent Supply Chain Attack

Summary

Description

Skill Identity

Skill: AI Agent Supply Chain Attack

Summary

Description

Skill Identity

Why this skill exists

Differentiation from ci-cd-supply-chain-attack

Use Cases

Core Tools

Methodology

Phase 1: Reconnaissance

Phase 2: Poision

Phase 3: Delivery

Phase 4: Trigger Design

Phase 5: Persistence

Phase 6: Exfiltration

Defense Perspective

Detection Methods

Sigma Rule: Pickle Import in Production

YARA Rule: Pickle RCE Pattern

Falco / Tetragon Rule: Model Inference Network Call

Defense Evasion Techniques

Practical Steps

Step 1: Reconnaissance

Step 2: Pick your vector

Step 3: Build payload

Step 4: Deliver

Step 5: Activate

Step 6: Persist

Step 7: Exfiltrate

Common Pitfalls

Cross-Reference to Related Skills

Hacker Laws Alignment

References

Attribution

Differentiation from `ci-cd-supply-chain-attack`