Supply Chain Attacks Are Coming for Your AI Pipeline

The two AI-specific supply chain attack paths

Path 1: GitHub Actions workflow tampering (T1195.002)

The T1195.002 path targets your CI/CD pipeline directly. For an AI pipeline, the high-value targets in a GitHub Actions workflow are:

• The model download step — replace a model artifact URL with a malicious checkpoint
• The fine-tuning data push — inject poisoned samples before the training run
• The agent deployment step — swap a known-good agent SFA with a backdoored one
• The secret injection step — capture ANTHROPIC_API_KEY or similar at pipeline runtime

The attack surface is any GitHub Actions action referenced by tag (uses: actions/checkout@v4) rather than by full commit SHA. Tag-based references can be silently redirected by a compromised or maintainer-hijacked upstream repo without any change to your workflow file.

# VULNERABLE: tag-based action reference
- uses: actions/setup-python@v5     # can be redirected

# HARDENED: full commit SHA — immutable
- uses: actions/setup-python@42375ac2eaa873de89a0dd8a8c9dbb2a0cec3ae9  # v5.1.0

Path 2: ML supply chain compromise (AML.T0010 + AML.T0104)

AML.T0010 (ML Supply Chain Compromise) and AML.T0104 (AI Pipeline Tampering) describe two sub-paths:

• Model artifact poisoning: a tampered model checkpoint distributed through Hugging Face, a model registry, or a shared S3 bucket. The model loads and passes behavioral tests, but triggers on a specific input pattern to perform attacker-controlled actions.
• Training data poisoning: attacker-controlled content injected into the training corpus shifts model behavior for specific query types. The effect is persistent across fine-tune cycles until the poisoned samples are identified and purged.

Five hardening controls for AI CI/CD

1. Pin GitHub Actions to full commit SHAs

Replace every @v{N} tag reference with the corresponding full SHA. Use StepSecurity Harden-Runner or Botkube to automate this across all workflows. This closes the T1195.002 tag-redirect vector entirely.

2. Hash-verify all model artifacts

Store expected SHA-256 hashes of model artifacts in a signed manifest in your repo. Verify before loading:

import hashlib

def verify_model_artifact(path: str, expected_sha256: str) -> bool:
    h = hashlib.sha256()
    with open(path, "rb") as f:
        for chunk in iter(lambda: f.read(65536), b""):
            h.update(chunk)
    actual = h.hexdigest()
    if actual != expected_sha256:
        raise SecurityError(f"Model artifact hash mismatch: {actual} != {expected_sha256}")
    return True

Maps to NIST AI RMF MAP-1.6 (map AI system components) and NIST CSF DE.AE-02 (anomaly detection).

3. Scope workflow permissions to minimum required

Set permissions: read-all at the workflow level, then grant the minimum needed for each job. An AI pipeline that only reads model artifacts and runs inference needs zero write permissions.

permissions:
  contents: read       # minimum for checkout
  id-token: write      # only if OIDC auth is needed
  # NO: actions: write, packages: write, etc.

This limits the blast radius of T1195.002: even if a workflow step is compromised, it can't push to the repo or write to the package registry.

4. Behavioral regression testing on model updates

For every model update (fine-tune, quantization, version bump): run a behavioral probe battery — a fixed set of prompts with expected outputs — before promoting to production. A poisoned model will fail on the probes that specifically test for the backdoor trigger pattern.

This is the runtime defense against AML.T0010. Map each probe to an ATLAS technique: include injection probes (AML.T0054), jailbreak probes, and capability-regression probes. Log all results with model artifact hash for traceability.

5. Dependency hash locking with CI enforcement

Lock all Python dependencies to exact hashes in requirements.txt or pyproject.toml, and verify them in CI:

# requirements.txt with hash locking
anthropic==0.30.0 \
    --hash=sha256:abc123...
torch==2.2.0 \
    --hash=sha256:def456...

# CI check: fails if any dep hash mismatches
pip install --require-hashes -r requirements.txt

This addresses AML.T0104 at the Python dependency layer and aligns with NIST AI RMF MANAGE-2.2 (manage AI system risks throughout the lifecycle).

Framework mapping