Detecting AI Supply Chain and Infrastructure Weaknesses

AI supply chain and infrastructure weaknesses exist before and below the application layer. Unsafe model file formats allow arbitrary code execution when loaded. Exposed ML pipelines give access to training infrastructure. Open cloud AI service endpoints bypass application-layer controls. Vulnerable AI framework versions contain known exploitable bugs. These findings often provide deeper access than application-layer attacks and are less likely to be detected by application security monitoring.

Scan Model Files for Unsafe Serialization

PyTorch model files in the legacy .pkl or .bin format use Python pickle serialization which allows arbitrary code execution on load. Check model files for unsafe formats:

fickling disassembles pickle files and detects calls to dangerous operations like os.system, subprocess, or exec embedded in the serialized model. A model file containing arbitrary code executes that code when anyone loads the model with PyTorch. The safer format is .safetensors — its presence indicates the organization has some supply chain awareness. The presence of .bin or .pkl files from unverified sources is a critical finding.

Audit AI Framework Dependencies for Known CVEs

AI frameworks have a history of security vulnerabilities including arbitrary code execution, path traversal, and SSRF. Audit the dependency stack:

Notable vulnerabilities to check for: LangChain has had multiple arbitrary code execution CVEs in its Python REPL tool and SQL chain. Gradio has had path traversal and SSRF vulnerabilities. Transformers has had issues with unsafe deserialization. Cross-reference identified versions against the NVD and framework changelogs.

Identify Exposed ML Pipeline Infrastructure

MLOps platforms like MLflow, Weights and Biases, and Kubeflow expose experiment tracking and model registry interfaces. These are frequently left without authentication in development environments that get promoted to production:

An exposed MLflow instance gives access to model artifacts, training runs, experiment parameters, and registered models. Model artifacts in MLflow are often pickle files — directly downloadable and scannable for malicious content. Registered model versions can be replaced with attacker-controlled versions if write access is available.

Check Cloud AI Service Misconfigurations

Scan for misconfigured cloud AI services using Pacu for AWS or ScoutSuite for multi-cloud environments:

Check for Exposed Jupyter Notebooks

Jupyter notebooks in production AI environments often contain training code, API keys, and data processing pipelines. An exposed Jupyter instance without token authentication provides direct code execution:

An accessible kernels endpoint without authentication confirms Jupyter is running without token protection. The contents endpoint lists all notebooks and files accessible to the server. A running kernel can execute arbitrary Python code — this is a critical finding equivalent to an unauthenticated remote code execution vulnerability.