AI Supply Chain Risk: The New Third-Party Threat

Traditional vendor risk management fails to address AI supply chain risks from model weights, embeddings, and agent frameworks. Attack vectors include model serialization attacks, RAG poisoning, and compromised inference APIs. A financial services scenario shows how poisoned retrieval data can bypass input filters and trigger unauthorized actions.