Hidden Dangers Of AI In Developer Workflows: Navigating... with Dwayne McDaniel
summary
Shows a real supply-chain incident where an NX library contained a supply chain prompt injection that exfiltrated keys, cites GitGuardian research finding 23.77 million secrets leaked to GitHub in 2024 (4.6% of updated repos, 6% for Copilot fingerprints), demonstrates a working Django QR-code app built with Cursor, and catalogs practical risks—hardcoded credentials, PyPI typos and a reported ~768–4,000 exposed package credentials, hallucination squatting—plus concrete mitigations like pre-commit hooks, guarded registries, and OWASP/OASP guidance.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:04Security beyond CVEs
- 3:09Predictive vs generative AI
- 3:52NX breach case study
- 5:16Why dev is hard
- 7:43AI false security
- 8:46AI code demo
- 10:51GitGuardian research
- 12:58AI worsening the hardcoded credential problem
- 14:20Hallucinations and typo squatting in AI dependencies
- 16:51Mitigating AI deps
- 17:53Agentic AI risks
- 20:21Overprivileged agents
- 21:24System thinking vs AI
- 23:32Secure AI cycles
- 24:36DevOps feedback loops
- 25:40Final recommendations
- 26:01Closing
related talks
58mSecuring Code in the Age of AI
26mSmarter Code, Sneakier Risks: Supply Chain Security in the Age of AI
45mThe Dark Side of AI: The Hidden Supply Chain Risks in Open...
31mThe internet is broken: breaking down the software supply chain
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
01h 02mHow AI is impacting cybersecurity. Does it?
37mAI, the Software Supply Chain, and Other (Not So) Puzzling Pieces
30mWhat Are the Security Risks Associated with AI-Generated Code? 🤔