Software Procurement

Software procurement is the process by which organizations evaluate, buy, and contract for software, including AI tools and models supplied by outside vendors. For AI governance, it is the main checkpoint where risk gets set: contract terms decide who owns training data, how outputs are used, what security and audit rights the buyer holds, and who bears liability when a system fails. Compliance and legal teams that review purchases before signature can shape these terms, while teams that adopt tools without going through procurement often create exposure they never see.

1 item

ResearchGlobal2026-10-28

Signed AI Binaries Are Not Safe: Yoba Malware Exploits ChatGPT and Claude App Lures

Check Point Research has documented an active malware campaign called Yoba that distributes cryptomining software through fake ChatGPT and Claude desktop applications. The fake apps bundle legitimate, digitally signed executables from OpenAI and Anthropic with malicious code, letting attackers bypass signature-based trust controls. The campaign reaches victims through search-engine-optimized fake repositories on GitHub, exploiting employee demand for unsanctioned AI tools.

shadow IT AI software supply chain malware ChatGPT Claude OpenAI Anthropic software procurement