NCSC guidance explains that machine-learning workflows inherit software-supply-chain risks. Downloading a model or adding a package can introduce executable code as well as useful functionality.
AI software supply chain and downloaded models
The NCSC discusses risks in loading pretrained models, including Python Pickle deserialisation, which can execute code. It identifies alternative formats, scanning tools and trusted sources or verified hashes and signatures as considerations. It also cautions that scanning may not detect the most sophisticated exploits. A model file should not be assumed harmless solely because it is described as data.
Implementing Cyber Security for AI
The same guidance discusses dependency confusion and malicious packages distributed through public repositories. Its examples show why source selection, access controls and software updates remain relevant in AI projects. Those historical incidents explain attack mechanisms; they do not establish that every package on a public registry is malicious or that every current release remains affected.
Keep responsibility with the system operator
Higgins’s commentary argues that attributing failures to rogue agents can distract from the organisations controlling the system. That argument should remain attributed. For supply-chain decisions, the technical question is what code is being loaded, from which source and with what authority, rather than whether the software can be described in human terms.
Sources and further reading
There are no “rogue” AI agents - by Eoin Higgins
https://eoinhiggins.substack.com/p/there-are-no-rogue-ai-agents
Thinking about the security of AI systems | National Cyber Security Centre
https://www.ncsc.gov.uk/blog-post/thinking-about-security-ai-systems
AI Adoption Research - GOV.UK
https://www.gov.uk/government/publications/ai-adoption-research/ai-adoption-research