AI Supply Chain Risk

AI supply chain risk encompasses the vulnerabilities and threats that emerge when organizations depend on external vendors, cloud providers, model repositories, and data sources for their AI systems. These risks include compromised training data, malicious model weights, unvetted third-party components, and vendor lock-in that can propagate security flaws or bias throughout an entire AI deployment. Managing supply chain risk is critical for enterprise governance because a single compromised dependency can undermine data integrity, regulatory compliance, and the trustworthiness of downstream AI applications across the organization.

1 item

ResearchGlobal2026-07-29

Unpatched AI Worm in Microsoft Copilot for Word Can Self-Replicate Through Enterprise Documents After 144-Day Disclosure Window

Security researcher Hakon Maloy has demonstrated a self-propagating prompt injection attack against Microsoft Copilot for Word that enables attacker-controlled instructions hidden in externally sourced documents to alter the content of newly drafted documents and copy the malicious payload forward into subsequent files. The vulnerability remained exploitable against the latest available model after a 144-day coordinated disclosure with Microsoft's Security Response Center. Because no vendor patch is available, enterprise document-handling policies and untrusted-source controls are currently the only available mitigations.

Microsoft Copilot prompt injection AI worm AI supply chain risk agentic AI document integrity Microsoft