An AI application can have secure code and still depend on components with excessive access.
Model gateways, MCP servers, agent SDKs, coding agents, evaluation frameworks, provider packages, and CI/CD integrations often run close to source code, cloud credentials, production data, and deployment systems.
A software bill of materials identifies components. Production AI also needs an authority map.
For each dependency, record:
The central question is direct:
If this component became malicious, what could it read, change, or deploy using the authority already granted to it?
The 2026 LiteLLM incident shows why vulnerability scanning alone is insufficient. LiteLLM’s official security update confirmed that PyPI versions 1.82.7 and 1.82.8 contained malicious packages designed to harvest credentials; official Docker images were not affected. Endor Labs reported that the malicious code was absent from the corresponding upstream GitHub source. The distributed artifact—not the visible repository—was compromised.
Control high-authority dependencies through approved registries, artifact quarantine, integrity or signature verification where available, source-to-artifact comparison, and exact version or immutable image pinning. Do not fetch floating versions during production builds.
Before go-live, leadership should know whether every high-authority component has an owner, minimal access, fast revocation, a controlled artifact source, and a tested clean replacement.
Cayru can inventory AI dependencies, map inherited authority, and prioritize remediation by practical blast radius.
Map what every AI dependency can access—and how quickly that access can be revoked.