How to implement an AI Software Bill of Materials (AI-SBOM) that captures the full component graph of a deployed AI system — base models, adapters, training datasets, and dependencies — and how to use it to manage supply chain risk and regulatory compliance.
Threat actors are embedding prompt injection payloads in third-party LLM plugins and data sources to hijack AI agent actions, exfiltrate data, and pivot within enterprise environments.
A newly attributed state-sponsored threat actor is systematically targeting AI development infrastructure to poison training datasets and embed persistent backdoors in commercially deployed models.
New research demonstrates that backdoor behaviours introduced into LLMs during fine-tuning can persist through subsequent safety alignment procedures, including RLHF and adversarial training, posing significant supply chain risks.
NIST has released version 2.0 of the AI Risk Management Framework, significantly expanding guidance on adversarial ML threats, model supply chain security, and AI-specific incident response. Key changes for security teams.