6. Supply Chain and Infrastructure

6.1 The AI supply chain is wider than the software supply chain

Organisations consume foundation models and hosted APIs, fine-tuned adapters, open-source frameworks, datasets, embedding models, vector stores, evaluation tools, agent frameworks, plugins and tool servers, and GPU and cloud infrastructure. Foundation models in particular concentrate capability into reusable artifacts; a single model may sit beneath thousands of downstream applications, creating concentration risk [26]. The security boundary is distributed across suppliers and cannot be reduced to the organisation's own code. OWASP lists supply chain as LLM03 [11] and, for agents, ASI04 [12]; ENISA's 2020 threat-landscape report already emphasised the supply chain as a significant dimension of AI cybersecurity [9]. [Documented]

[Analysis], with sources as cited.

Reported incidents. The OWASP Round-up for Q1 2026 describes malicious package updates in AI-related tooling and the rapid weaponisation of leaked artifacts among its incidents [13]. [Reported] Read the primary report for incident specifics; this paper does not restate them.

6.2 Provenance, signing and an AI bill of materials

Practical goals: know exactly which model, dataset, prompt, adapter and package versions are running in each environment; be able to prove they match what was approved; and be able to answer "are we affected?" within hours when an upstream component is disclosed as compromised.

Recommended minimum record per AI system: model name, provider, version/hash; dataset sources and snapshots; fine-tuning lineage; framework and package versions; prompt and policy versions; tool definitions; evaluation results tied to those versions. Machine-readable inventories exist in SBOM tooling and may be extended to ML artifacts; check the current capabilities of your chosen format before committing to it. [Analysis]

Change control. Treat a model, prompt, retrieval-corpus or policy change as a release. A control that passed at deployment may not hold after a provider-side model update. Re-run security evaluations whenever any upstream component changes.

6.3 Infrastructure and cloud

Most infrastructure risk in AI systems is conventional risk at a higher stakes level: GPUs and accelerators are expensive and attractive for abuse; model weights and datasets are large, valuable files; clusters often have broad internal permissions to move data; and notebooks and experiment tooling are frequently less hardened than production. [Analysis]