AI-Enabled Cyber Threats and Security Risks Across Cloud-Based Supply Chains: A Systematic Literature Review of Attack Vectors, Trust Exploitation, and Defensive Frameworks

Abstract

One of today's most powerful attack surfaces in the world of cybersecurity is cloud chains, which is the web of cloud infrastructure providers, software dependencies, application programming interfaces, software-as-a-service (SaaS) integrations, and more recently, artificial intelligence (AI) models and pipelines that organizations utilize. As AI tools bolster cloud security, they also allow attackers to breach trusted relationships, manipulate machine learning models and training data, and conduct multi-stage intrusion attacks at an unprecedented speed and with very little human effort. This paper systematically reviews the existing research literature focusing on AI-related cyber threats and security risks to cloud-based supply chains, bringing together relevant and peer-reviewed IEEE Access and ACM Computing Surveys publications, NIST and MITRE standards, and real-time threat intelligence. The review showcases a taxonomy of five major threat categories – model and training data poisoning via the supply chain, malicious open source package and dependency injection attacks, OAuth and SaaS-to-SaaS trust exploitation, attacks on cloud-hosted ML defenses, and the first AI-powered autonomous attack campaign – and documented real-world attacks such as the SolarWinds compromise, the 2025 Salesloft Drift OAuth supply-chain attack affecting more than 700 organizations, the Shai-Hulud npm worm, and the first public disclosure of an AI-powered autonomous cyber espionage attack. The review further breaks down defensive frameworks, such as Software Bills of Materials, the Adversarial Machine Learning Knowledge Base provided by the MITRE organization, and zero-trust identity governance, and shows that there is a significant disconnect between what has been demonstrated in defensive capabilities and what's actually being adopted in enterprises. The review ends with a proposed defense in depth strategy for cloud-based supply chains and outlines open research areas such as standardized verifiers of the provenance of AI supply chains and cross-organization trust-relationship monitoring.