Tagged "supply-chain-security"

12 articles tagged supply-chain-security, 22 February 2026 to 11 August 2026. Newest first.

• DEF CON 34 Exposes 10 Critical Vulnerabilities in Local AI Systems 11 August 2026

  Security researchers at DEF CON 34 identified 10 significant vulnerabilities affecting local AI deployments, highlighting critical gaps in model serving frameworks, quantization libraries, and inference runtime security. The findings emphasize the need for hardening local LLM infrastructure before production deployment.

• Supply Chain DLP: Stop Leaked .env Files, Credentials, SSH Keys, and API Tokens 2 June 2026

  A security-focused tool and framework for preventing credential leaks in development and deployment pipelines, critical for teams running local LLMs with sensitive infrastructure.

• Show HN: Egress WAF to Limit AI Agents and NPM Malware Based on mitmproxy 31 May 2026

  A new Web Application Firewall project built on mitmproxy that provides security controls for AI agents and local deployments, addressing emerging threats in self-hosted LLM environments.

• AI, open code and vulnerability risk in the public sector 15 May 2026

  UK government guidance addresses security considerations for deploying AI and open-source code in public sector systems. Essential reading for organizations deploying local LLMs in regulated or high-security environments.

• Claude Opus 4.7 System Prompt Leaks Raise Local Deployment Questions 14 May 2026

  Security researchers report Claude Opus 4.7 randomly leaking its system prompt, highlighting vulnerabilities in proprietary models and reinforcing the case for transparent, locally-controlled LLM deployments.

• Mass NPM Supply Chain Attack Hits TanStack, Mistral AI, and 170 Packages 12 May 2026

  A large-scale NPM supply chain attack compromised multiple packages including those from Mistral AI and TanStack, affecting local LLM tooling and JavaScript-based deployment frameworks.

• US State Dept Orders Global Warning About Alleged AI Thefts by DeepSeek 5 May 2026

  International security alert regarding alleged intellectual property theft by DeepSeek has implications for open-source model licensing, supply chain security, and local LLM deployment strategies.

• Malicious GGUF Models Could Trigger Remote Code Execution on SGLang Servers 21 April 2026

  Security researchers have identified a critical vulnerability where specially crafted GGUF model files can achieve remote code execution on SGLang inference servers, posing significant risks to organizations running local LLM deployments.

• On-Device AI Inference Emerges as New Security Blind Spot for CISOs 13 April 2026

  Security research identifies critical gaps in organizational understanding of on-device AI inference risks and safeguards. This analysis highlights essential security considerations for enterprises deploying local language models.

• If Your AI Agent Ran NPM Install During the Axios Attack, You're Compromised 1 April 2026

  A critical security warning for AI agents and autonomous systems that execute code or package management commands. The article highlights how AI agents autonomously running npm install during known supply chain attacks can compromise entire deployments, raising important security considerations for self-hosted and edge LLM applications.

• Critical: LiteLLM Supply Chain Attack Detected, Bifrost Alternative Released 25 March 2026

  PyPI versions 1.82.7 and 1.82.8 of LiteLLM were compromised with credential-stealing malware. The community has compiled alternatives including Bifrost, a Go-based replacement claiming 50x faster P99 latency.

• Security Alert: Fraudulent Shade Software Plagiarized from Heretic Project 22 February 2026

  A critical security and integrity issue has emerged where a malicious actor aggressively promoted a tool called Shade that is entirely plagiarized from the legitimate Heretic project, highlighting supply chain risks in the local LLM tooling ecosystem.