Worms, Tokens, and Trust The Industrialization of Supply Chain Attacks
summary
Claims that LLMs can spot fixes and malware faster than CVEs and a working pipeline that scrapes 5 million changelogs and analyzes code drive the talk: 2,106 vulnerabilities discovered, 67% never reported and 56% of critical flaws not disclosed. Examples include the debug compromise (4.5 hour active window, 10% of cloud accounts infected, 99% exposed), Trivy/TeamPCP and the Canister Worm, and ongoing Glassworm variants. The group publishes results on Akido Intel and uses SCA plus LLMs to detect issues before CVEs appear.
AI-written summary · about
chapters (10)
- 0:00Supply chain attacks intro
- 3:05Open source dependency chains
- 8:24Why CVE systems fail
- 11:34Detecting vulnerabilities early
- 15:50Silent patching vulnerabilities rise
- 17:33Malware in open source packages
- 20:45Real-world malware impact
- 22:31Attackers targeting developers
- 23:55Dangerous malware examples
- 28:08Live Glassworm demo
related talks
36mUsing AI to Discover Silently Patched Vulnerabilities in Open...
01h 01mWorms in our software supply chain - Where do we go from here?
36mCompromising LLMs: The Advent of AI Malware
01h 02mInside Today’s AI-Accelerated Software Supply Chain Attacks
46mThe Rise of Malware Within the Software Supply Chain
16mPerformance improvements: exposing hidden security fixes in Open Source
42mKeynote: The Expanding Universe of Cyber Threats
28mSecuring LLMs: Insights into OWASP top 10