JCC logo
OWASP Risks Atlasby Jer Catallo

Issue Details

Supply Chain Vulnerabilities

llm05-2024 • Rank #5 in OWASP 2025

Explanation

LLM supply chain vulnerabilities emerge from compromised models, datasets, plugins, SDKs, and hosting dependencies. A single weak link can introduce malicious behavior, data leakage, or policy bypass into production systems. The distributed nature of AI stacks increases complexity and weakens traditional dependency controls.

Remedy

Adopt provenance verification for models and dependencies, pin versions, and enforce trusted artifact sources. Continuously scan third-party components for vulnerabilities and policy violations. Maintain rollback-ready deployment controls and periodic supplier risk reviews to reduce compromise impact.

YearRankCategory
2024#5llm05-2024 - Supply Chain Vulnerabilities