ML/LLM supply-chain attacks

When it applies

The target consumes third-party ML artifacts: downloaded model weights, datasets, tokenizers, plugins/extensions, or fine-tuning data. Each is code or data that runs with the app's trust.

Why it works

Model files are frequently pickle-based (torch.load, .pkl, joblib) — loading them executes arbitrary code (__reduce__), so a malicious model on a hub is RCE on whoever loads it. Datasets and RAG corpora poison behavior; plugins/extensions run with the assistant's privileges; typosquatted ML packages inject code at install.