Assessment run

Meridian Logistics Group genuinely owns the RouteHelp brain in the ways that matter most: the model weights are open and self-hosted in Meridian's own cloud account, and the platform team confirmed the whole stack could be rebuilt elsewhere with no loss of capability. The weakness is not where the model lives but who decides when it changes. Every week the deployment pipeline downloads a fresh copy of the embedding model from a public model hub, identified only by a version label and not by a fingerprint that proves the file is the same file, and nobody reads the accompanying documentation or tests the new model before it serves live answers. In practice the decision about how RouteHelp behaves rests with an anonymous publisher on a public website who owes Meridian no notice, no explanation and no warning, and who can push a change at any moment.

Rating HIGH. Meridian can move this system anywhere it likes, but it cannot currently tell you who changed the model's behaviour last week, or whether anyone checked.

Meridian deliberately feeds RouteHelp its support knowledge base together with 40 million customer shipment records so the assistant can look up answers. Because the weekly downloaded components run inside the same process as that lookup, any tampered package, model file or tokenizer would read those documents in full and in the clear, not in fragments. The same components decide what gets indexed and what gets handed back, so a tampered component could also quietly insert false content that the assistant and the agents reading it would treat as genuine company material. Incidents of exactly this kind — tampered packages and model files pulled from public repositories that harvested everything they touched — are documented in the wild, not merely theorised. Because the corpus contains personal data about senders and recipients, exposure of even part of it would be a reportable personal-data breach for Meridian as controller.

Rating HIGH. The single most sensitive dataset Meridian holds is readable, and silently rewritable, by whatever code the pipeline happened to download last week.

The vector database that holds the processed form of the knowledge base and the 40 million shipment records is self-hosted in Meridian's own cloud account, so there is no third-party store, no outside contract and no foreign jurisdiction over it — a genuine strength. However, this store is the one lasting copy of everything Meridian has fed the assistant, and the weekly-downloaded components hold the application's own access rights to it, so there is no internal barrier between unreviewed code and the entire index. It is also worth recording that the processed form is not an anonymised abstraction: the numerical representations produced by this kind of model can be worked back into meaningful information about the original text. A tampered component could therefore copy the whole derived corpus out, or quietly alter what the assistant retrieves, and Meridian has no way to tell which entries were changed.

Rating HIGH. Keeping this database in-house removes the outside-party problem entirely but does nothing to limit how much is lost if a downloaded component misbehaves.

The framework that coordinates RouteHelp — deciding what to retrieve, how to assemble the question put to the model, and what text reaches the agent's screen — is installed from a public package registry and refreshed weekly without review. Self-hosting means no outside supplier watches these steps, which is a real benefit; the trade-off is that the integrity of this central component now rests entirely on code nobody at Meridian inspects. Whoever can publish a release under that package name can change the coordinating logic, and would be running inside Meridian's trust boundary with the system's own credentials to the knowledge base and shipment records. This is a well-documented attack route: published packages have been updated after gaining adoption specifically to silently copy everything passing through them, and security researchers have found numerous remote-code-execution flaws across this family of frameworks.

Rating HIGH. The component that controls what RouteHelp sees, says and reaches is replaced every week by an outside party on trust alone.

Because Meridian uses no commercial AI supplier, no outside staff, contractors or annotators ever see its prompts, outputs or logs — the usual concern in this area simply does not arise. The gap runs the other way: the only people in the loop are Meridian's own customer-service agents in twelve countries, who read RouteHelp's answers and act on them with no way to tell a correct answer from a quietly altered one. There is no verification step, no record of what changed in the weekly update, and no signal shown to the agent, so an altered or poisoned answer would look exactly as authoritative as a correct one. Any single upstream change reaches all twelve countries at once, with no case-by-case review to interrupt it.

Rating MEDIUM. No outsiders are reading Meridian's data, but no one inside Meridian is in a position to catch a bad answer either.

The control plane is reassuringly Meridian's own — the build system and cloud console sit in its own account with no outside administrator. What undermines that is Meridian's own written practice for the pipeline: dependencies identified by version label only, an automatic weekly download, and no approval gate before anything reaches production. That configuration is precisely what converts a stranger's decision into a Meridian production change that nobody at the company authorised or recorded. Reusing a version label is enough to satisfy the current check, so an outside publisher does not need to defeat any safeguard; the policy lets the change through by design.

Rating HIGH. Meridian holds the steering wheel, but its own change-control policy hands the wheel to an outside publisher once a week.