AI Vendors Now Classified as Supply-Chain Risks, Urging Businesses to Diversify

·4 views

A U.S. appeals court this week upheld a ruling designating a major AI company as a supply-chain risk, placing it in the same category as critical hardware suppliers or geopolitically exposed manufacturers. The decision highlights growing concerns that businesses relying heavily on a single AI vendor face significant operational vulnerabilities. Experts warn that modern companies often build core functions — including customer support, marketing, and logistics — on third-party services they do not control, creating hidden dependencies. A vendor's pricing change, policy update, or service disruption can cascade through a business before the underlying risk is even identified. To reduce exposure, businesses are advised to abstract vendor integrations, maintain tested fallback providers, own their core data assets, and treat platform and API dependencies as formal continuity risks.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Meta's AI Dojo Concept Shows Training Environments Boost Agent Performance

A DEV Community article by Nokka, published in September 2026, explains the concept of an 'AI Dojo' — a training environment where AI agents can repeatedly attempt tasks, fail, and improve, as opposed to traditional one-time benchmarks. The piece argues that standard benchmarks measure whether an agent can pass a test, but do not allow it to learn from its own failures in a structured way. Meta's FAIR research team demonstrated this distinction in mid-2025 by moving an existing AI agent called AIDE into their AIRA-dojo environment without modifying the agent itself, which raised its Kaggle medal rate from 35.2% to 45.9%. Further adjustments to the agent's operator instructions and search strategy pushed that rate to 47.7%, with the researchers attributing the gains to the training environment rather than changes to the model. The article is the first in a five-part series exploring how AI Dojos work and how smaller teams can apply the approach in practice.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How One Freelancer Built an ML Portfolio From Scratch and Landed Paying Clients

A freelance machine learning developer shares how he went from zero production experience to earning a living through ML work within roughly three years. His first paid engagement came from a Dubai logistics firm that needed warehouse demand forecasting, a project he accepted before fully knowing how to execute it. An initial model that underpredicted demand by 40% was iterated into an ensemble approach that came within 6% of actual figures, eventually expanding to a second warehouse. He argues that most developers struggle to win ML clients not because they lack skills, but because they showcase credentials rather than verifiable, business-relevant evidence. His core advice is to build a focused project tied to a real business problem — such as churn prediction or inventory anomaly detection — that a non-technical buyer can evaluate within five minutes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Critical Elementor CSRF Flaw Lets Attackers Create Admin Accounts on 2M+ Sites

A critical cross-site request forgery vulnerability in Elementor versions 4.3.0 and 4.3.1 allows attackers to create administrator accounts on WordPress sites with the Editor Events experimental feature enabled. The flaw stems from a flawed partial URL match in the REST API authentication filter, which bypasses WordPress nonce validation when a crafted link is opened by a logged-in administrator. An attacker only needs to trick an authenticated administrator into clicking a specially constructed URL, after which the WordPress REST API processes the malicious request using the victim's own session credentials. Patchstack, which published the disclosure on September 25, 2026, assigned a CVSS score of 8.8, though the overall impact is assessed as critical given the potential for full site takeover. No active exploitation has been reported, and users are advised to update immediately to Elementor version 4.3.2 or later.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why MCP Server Deployment Differs Sharply Between Desktop and Hosted Environments

A developer essay on DEV Community compares two real-world Model Context Protocol server deployments: one embedded in Hiberden, a desktop LTO tape archiving app, and another powering Easy2257, a hosted compliance records service. The desktop server runs as a local subprocess over stdio, meaning it has no open network port and relies on the operating system for access control rather than custom authentication. The hosted server, by contrast, serves multiple tenants over the internet and must verify identity and entitlements on every single request, making authentication the core engineering challenge. Distribution also diverges: the desktop version ships inside an installer and is listed in MCP registries, while the hosted version requires only account creation and clear connection documentation. The author argues these differences are not stylistic choices but are determined almost mechanically by where the data lives and how users access it.

0 comments Read more at DEV Community