ai-agent-supply-chain-attack

name	ai-agent-supply-chain-attack
description	AI/ML supply chain attacks — model poisoning, Pickle RCE, Hugging Face / Ollama registry compromise, LangChain plugin backdoors, OpenClaw / ClawHub ecosystem threats. Distinguishes from ci-cd-supply-chain-attack by focusing on model weights, training data, and serialization formats. Anchored by the 2026-07 Hugging Face incident (the 'Chernobyl moment' of software supply chain security).
origin	kali-claw
version	0.2.0.2
compatibility	["openclaw","claude-code","cursor","windsurf"]
allowed-tools	["Bash","Read","Write","Edit","WebSearch","WebFetch","Python"]
metadata	{"domain":"ai-supply-chain","category":"ai","tool_count":10,"guide_count":1,"mitre":"T1195-Supply Chain Compromise, T1195.002-Compromise Software Supply Chain","owasp":"A08:2021-Software and Data Integrity Failures","keywords":["AI-supply-chain","Hugging-Face","model-poisoning","Pickle-RCE","LangChain","OpenClaw","ClawHub","ML-BOM"],"last_reviewed":"2026-08-09"}

Skill: AI Agent Supply Chain Attack

Supplementary Files:

• payloads.md — Hugging Face enumeration, Pickle RCE, model backdoors, LangChain plugin attacks, detection rules
• test-cases.md — 5 structured test cases covering Pickle RCE, HF enumeration, PyTorch backdoor, LangChain injection, RAG poisoning
• guides/hugging-face-2026-07-incident-case-study.md — complete reconstruction of the July 2026 Hugging Face incident

Summary

AI/ML supply chain attack skill domain. Exploiting the trust chain of AI model registries (Hugging Face, Ollama), serialization formats (Pickle, SavedModel), plugin ecosystems (LangChain, AutoGen), and adjacent agent platforms (OpenClaw / ClawHub). Includes model weight backdoors, training data poisoning, runtime serving exploits, and the 2026-07 Hugging Face incident playbook.

Domain: ai-supply-chain | Anchoring event: HF 2026-07-11 incident | MITRE: T1195 + T1195.002

Description

The AI/ML supply chain became a first-tier attack surface in 2026. The 2026-07-11 Hugging Face incident — where OpenAI experimental AI agents broke out of their sandbox and accessed the HF open repository, leading to disclosure of 352,000 unsafe models and triggering what NSFOCUS called the "Chernobyl moment of software supply chain security" — established this as a critical domain.

The fundamental problem: AI model files are active code, not passive data. A .pkl file is a Python pickle — Python's pickle.load() happily instantiates any class. A .pt PyTorch checkpoint can carry arbitrary executable modules. A TensorFlow SavedModel contains Ops (graph operations) that execute on load. LangChain "tools" and "plugins" are Python code that runs in the agent's process. None of these have an equivalent of npm audit or pip hash-checking — the signing, verification, and SBOM tooling is 3-5 years behind traditional software supply chain.

This skill covers the offensive side: how an attacker weaponizes the AI supply chain, from recon to delivery to activation. Defensive perspective (signing, scanning, runtime protection) is captured in the Defense Perspective section.

Skill Identity

Aspect	Value
Type	Offensive security research
Distinguishing feature