Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Incident overview
Linux packages for PyTorch's pre-release version, called Pytorch-nightly, were compromised from December 25 to 30, 2022 by a malicious binary uploaded to the Python Package Index (PyPI) code repository. The malicious binary had the same name as a PyTorch dependency and the PyPI package manager (pip) installed this malicious package instead of the legitimate one.
This supply chain attack, also known as "dependency confusion," exposed sensitive information of Linux machines with the affected pip-installed versions of PyTorch-nightly. On December 30, 2022, PyTorch announced the incident and initial steps towards mitigation, including the rename and removal of `torchtriton` dependencies.
Why this record has no ERS
PyTorch confirmed malicious torchtriton installation in Linux nightly environments during December 25–30, 2022. The binary ran only on explicit triton import; no particular model training or inference workload and no artifact-admission behavior were identified.
Status: Not scorable by design · Classification: Incident · source date 2026-08-02 · primary evidence date 2022-12-25
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The flow documents what happened and which controls apply; it does not establish an assessed deployment.
| MITRE ATLAS case study | AML.CS0015 (incident) |
|---|---|
| Target | PyTorch |
| Actor | Unknown |
| Reporter | PyTorch |
| Primary evidence date | 2022-12-25 |
| SecureFlow record updated | 2026-08-02 |
| AI layers | AI supply chain |
| Risk impact | Data exfiltration |
| Affected components | PyTorch-nightly dependency chain, PyPI package index, malicious torchtriton package, DNS exfiltration channel |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Upload Malicious Dependency to PyPIA malicious dependency package named `torchtriton` was uploaded to the PyPI code repository with the same package name as a package shipped with the PyTorch-nightly build. This malicious package contained additional code that uploads sensitive data from the machine. The malicious `torchtriton` package was installed instead of the legitimate one because PyPI is prioritized over other sources. See more details at this GitHub issue (https://github.com/pypa/pip/issues/8606). | AML.TA0004 AML.T0010.001 |
| 2 | Steal Local System DataThe malicious package surveys the affected system for basic fingerprinting info (such as IP address, username, and current working directory), and steals further sensitive data, including: - nameservers from `/etc/resolv.conf` - hostname from `gethostname()` - current username from `getlogin()` - current working directory name from `getcwd()` - environment variables - `/etc/hosts` - `/etc/passwd` - the first 1000 files in the user's `$HOME` directory - `$HOME/.gitconfig` - `$HOME/.ssh/*.` | AML.TA0009 AML.T0037 |
| 3 | Exfiltrate via Encrypted DNSAll gathered information, including file contents, is uploaded via encrypted DNS queries to the domain `*[dot]h4ck[dot]cfd`, using the DNS server `wheezy[dot]io`. | AML.TA0010 AML.T0025 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0015-compromised-pytorch-dependency-chain; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0015 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-003.001 | Software Dependency & Package SecurityExact SecureFlow defense-map identifier (flow atlas-aml-cs0015-compromised-pytorch-dependency-chain), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-2. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Tr-4 |
| AID-H-022.001 | Sandboxed Dependency InstallationExact SecureFlow defense-map identifier (flow atlas-aml-cs0015-compromised-pytorch-dependency-chain), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-2. Presence supplies no score credit. | Candidate evidence route | Ro-5 |
| AID-I-002.002 | Secure External AI Service ConnectivityExact SecureFlow defense-map identifier (flow atlas-aml-cs0015-compromised-pytorch-dependency-chain), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Cn-4 |
| AID-I-001.004 | Sandbox Network Egress RestrictionsExact SecureFlow defense-map identifier (flow atlas-aml-cs0015-compromised-pytorch-dependency-chain), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Pr-2 Cn-7 |
| AID-D-005.001 | AI System Log Generation & CollectionExact SecureFlow defense-map identifier (flow atlas-aml-cs0015-compromised-pytorch-dependency-chain), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |