AIJacking is a supply chain attack in which an attacker takes over a previously used model or dataset name in a hosted AI registry. Downstream users follow the old reference or redirect and unknowingly fetch attacker controlled content, which can corrupt machine learning pipelines or introduce malicious code.
What AIJacking Is in the Supply Chain
AIJacking is best understood as supply-chain compromise applied to hosted AI registries. The attacker exploits stale references, reused names, or redirects so downstream users fetch attacker-controlled model or dataset content instead of the legitimate artifact.
The key security property is trust in the registry namespace, because the consumer is often following an old pointer rather than validating the current source of truth. That makes the attack less about breaking a model and more about substituting one artifact for another in a place the pipeline already trusts.
How the Attack Works in Practice
AIJacking usually depends on a lifecycle gap: a model or dataset name is abandoned, deleted, or repurposed, but downstream code, notebooks, CI jobs, or automation still resolve the original reference. If the registry allows takeover of the old name or redirect target, the attacker can serve poisoned content under a familiar identifier.
The malicious payload may be a corrupted dataset, a backdoored model, or adjacent content that triggers unsafe behavior later in the pipeline. In some cases the harm is immediate, such as code execution during deserialization or post-processing; in others it is indirect, such as training corruption that silently degrades model quality over time.
Similar trust failures appear in broader artifact ecosystems, which is why SLSA is useful context for understanding provenance and integrity checks around machine learning supply chains. The same control instinct applies: know where the artifact came from, and do not rely on name continuity alone.
Why It Matters for AI Pipelines
AIJacking can undermine confidentiality, integrity, and operational trust at the same time. A compromised dataset can poison training or evaluation, while a compromised model artifact can embed malicious behavior, corrupt outputs, or create a hidden dependency on attacker-controlled infrastructure.
The risk is amplified because model and dataset references are often reused across teams and environments, so one stale pointer can affect many consumers. That makes AIJacking a supply-chain problem, not just a single-project hygiene issue.
In environments that depend on registry names for automation, the weakest point is often the assumption that an old reference still means the original publisher. Controls that strengthen artifact provenance, signed delivery, and registry governance help reduce that exposure, especially when paired with broader supply-chain guidance such as the NIST SP 800-53 Rev 5 Security and Privacy Controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-08 — Audit Log Management | Registry takeover and stale redirects require traceable artifact access and change visibility. |
| CIS-15 — Service Provider Management | AIJacking often exploits third-party hosted registries and inherited supply-chain trust. | |
| Recommendation — Log artifact lookups, redirects, and namespace changes so suspicious registry reuse is detectable. Review third-party registry controls and require provenance guarantees before consuming artifacts. | ||
| NIST CSF 2.0 | PR.DS — Data Security | The term centers on protecting model and dataset integrity across the supply chain. |
| GV.SC — Cybersecurity Supply Chain Risk Management | AIJacking is a supply-chain compromise of hosted AI artifacts and registry dependencies. | |
| Recommendation — Protect artifact integrity with provenance checks, immutability, and validated distribution paths. Govern registry ownership, artifact provenance, and supplier trust before downstream reuse. | ||
Practitioner Guidance
Why practitioners should care: Treat model and dataset names as mutable dependencies, not as proof of origin. If your pipeline consumes artifacts by name alone, a later takeover can turn an apparently routine fetch into a supply-chain compromise.
What to watch for: Stale registry references, orphaned namespaces, unexpected redirects, and artifact sources that are not pinned to a verified publisher or digest are the conditions that most often make AIJacking viable.
Practitioner takeaway: Use provenance, immutable references, and explicit ownership of registry namespaces so a historical name cannot silently become an attacker delivery path.
Risk and Threat Considerations
AIJacking is dangerous because it attacks trust in the artifact catalog itself, which means the compromise can look like a normal fetch from a familiar location. That makes the failure easy to miss and hard to distinguish from a legitimate update when teams rely on old names, redirects, or weak review of registry changes.
Failure mechanism: An attacker takes over an abandoned or previously used model or dataset identifier, then serves malicious content through the trusted lookup path, allowing poisoned artifacts or unsafe code to enter downstream workflows.
Impact: The result can be training data corruption, model backdoors, code execution during artifact handling, or broader pipeline compromise that spreads through repeated reuse of the tainted reference.
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
