Smarter Code, Sneakier Risks: Supply Chain Security in the Age of AI
summary
AI coding tools like GitHub Copilot and CodeWhisperer speed development—developers go from 1–2 PRs to 5–7 PRs a day and whole codebases refactor in weeks—but they also produce hallucinated dependency suggestions (example: a non‑existent “secure JSON parser”) and repeatable vulnerabilities. Researchers find top issues: path traversal, injection, crypto misconfigurations and hard‑coded creds; a six‑step chain shows how a fake package becomes malicious. Practical defenses include AI Bill of Materials generation from Hugging Face models, model signing with cosign/sigstore, dependency tracking and build monitoring.
AI-written summary · about
chapters (9)
- 0:00AI code risks
- 6:02AI code generation blind spots
- 10:57AI hallucinations in attacks
- 14:49Security gaps in AI code
- 17:23AI attack flows and provenance gaps
- 18:47Introducing AI Bill of Materials
- 20:11Mitigation for AI supply chain risks
- 21:56Demo: AI BOM generation
- 25:02Regulations and AI supply chain future
related talks
58mSecuring Code in the Age of AI
33mShipping Fast, Breaking Silently: Why AI-Generated Code Needs a Second Opinion
01h 02mHow AI is impacting cybersecurity. Does it?
41mCode Security Reinvented Navigating the era of AI
38mCode Security Reinvented: Navigating the era of AI
30mWhat Are the Security Risks Associated with AI-Generated Code? 🤔
32mCode Security Reinvented: Navigating the Era of AI
30mHuman vs AI: How to Ship Secure Code