Many AI startups hold beliefs about supply chain risk that do not survive a look at the documentation: that a model hub download is safe, that a release day scan is enough, or that a hosted API removes the problem. This post checks seven of them against primary sources.
Myth versus fact
| Myth | Fact |
|---|---|
| "Supply chain risk is only about code packages." | OWASP LLM03:2025 includes third party models, datasets, LoRA adapters, collaborative platforms, and unclear vendor data policies. |
| "A model from a popular hub is safe to load." | OWASP says to use models from verifiable sources and verify signatures and file hashes. Popularity is not provenance. |
| "Any model file format is equal." | Safetensors was designed to store tensors safely as opposed to pickle. File format changes what loading can do. |
| "A pinned version is a verified version." | pip says hash checking verifies downloads against hashes you record, and that it needs every requirement pinned and hashed. A pin alone does not verify bytes. |
| "We scanned at release, so we are clean." | New advisories appear after release. Rescan what is deployed. |
| "A hosted API removes our supply chain risk." | You still depend on SDKs, agent libraries, and provider terms. |
| "Our serving runtime is secure by default." | Runtime guides, such as vLLM's, say some routes sit outside the API key and internal traffic is unauthenticated by default. |
Why each fact matters
Models are supply chain. A model is an artifact someone else produced. Record its source, hash, license, and who approved it. See what goes in an ML BOM.
Format choices are controls. Choosing a safer file format is free. Pair it with source checks.
Pins plus hashes. Pinning stops surprise upgrades. Hashes stop a swapped file. You want both.
Time is a factor. The state of your dependencies changes without you touching them. A scan is a snapshot.
What to do this month
- Generate an SBOM for each service.
- Write a one page model source policy.
- Turn on hash checking for production installs.
- Schedule rescans of deployed images.
- Review the runtime's security guide against your configuration.
Try it yourself
Open the continuous monitoring demo and see how a dependency becomes a finding after release, with no code change on your side.
Click through it at your own pace, or open it full screen.
A short note on Safeguard
Safeguard offers SBOM and dependency scanning, policies and gates, and zero-day discovery. Try a free scan at gold.safeguard.sh/scan.
Quick check
Does safetensors make a model trustworthy?
No. It addresses one risk, code execution on load. The weights can still be poisoned or mislabeled, so provenance still matters.
Do we need an AI BOM?
An inventory of models, datasets, and packages is useful. CycloneDX describes an ML-BOM format for that purpose.
Sources
- OWASP LLM03:2025 Supply Chain
- Safetensors documentation
- pip: secure installs and hash checking
- vLLM security guide
- CycloneDX ML-BOM
Last reviewed: 19 October 2026.
