Search
Glossary1
Open the full glossaryFound 3 articles
AI Supply Chain Poisoning: When the Risk Hides in Models, Data, and Tools
An AI system's supply chain is far more complex than traditional software: model weights, training data, dependencies, external tools (MCP), and even prompts themselves can be tampered with. This article breaks down five links, why detection is so hard, and five practical defensive principles.
Supply Chain and Third-Party Risk: When Your Attack Surface Is Not in Your Own Building
Much of a modern enterprise's attack surface sits outside its own control: open-source packages, outsourced providers, cloud dependencies, SaaS tools. This article unpacks the risk mechanics of four supply-chain links, shows how attackers borrow a path in, and includes a third-party risk checklist you can use directly.
YC Open-Sources QM: Source-Level Teardown of the 'Whole-Company Agent Operating System' That Hit 12K Stars in 7 Days, with More Security Code Than Model Loops
On July 31, 2026, Y Combinator open-sourced its internal Agent system QM (Quartermaster). Clone test: 241K lines of TypeScript, 379 test files, 4 interchangeable harnesses (Pi/OpenCode/Codex/Claude Code), egress proxy re-resolves DNS for each request, three-person gate 'a wall, not a hole', npm supply chain 7-day cooldown period: complete source-level dissection