.avif)
endorlabs.comarticleEndor Labs: AI Security Guidance Batch (10 articles)
Endor Labs guide framing AI models as software dependencies subject to supply chain risk, covering a risk taxonomy (data, model, operational, ethical/legal), and mapping requirements from NIST AI RMF, EU AI Act (full obligations effective August 2026), and ISO/IEC 42001. It details concrete failure modes like data poisoning, model drift, hallucinations, and third-party model provenance issues from hubs like Hugging Face.
TL;DR Vendor guide on assessing AI model risk (supply chain, drift, bias) against NIST AI RMF, EU AI Act, and ISO/IEC 42001.
Technologies named here
- Hugging Face Hub models
- Endor Labs
- NIST AI RMF
- ISO/IEC 42001
- ISO/IEC 23894
- EU AI Act
- CISA and NCSC guidelines
- Hugging Face
Techniques named here
- Data poisoning
- Adversarial attacks
- Model backdoors
- Malicious model weight serialization
- Evaluation-gaming behavior
- Model drift exploitation
- Privacy leakage via model memorization
Related in AI Security
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
github.comadvisoryFlowise MCP Security Bypass Enables RCE
github.comrepoYesWeHack Claude Kit
jfrog.comarticle