Vibe-Check Your Vibe Code: Surviving the Era of Agentic Open Source Dependencies
summary
Claims that agentic code inflates commit volume and reproduces old vulnerabilities with measurable harms: hallucinated dependencies at ~5% commercial and ~22% open source, about 1–2% of common Docker images containing malicious packages, and CVE publication averaging 200+ per day in 2026. Concrete mitigations include dynamic cooldowns, dependency soak time and an API-backed system (deps.dev / Gossip) plus OpenSSF malicious package feeds and quarterly fix-it weeks, with data and tooling demonstrated.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:07Vibe coding risks
- 2:30Agents and dependencies
- 4:57Commit volumes vs humans
- 6:22Maintainer burnout
- 7:06Slop squatting
- 9:30Vulnerable code patterns
- 11:15CVEs and shadow risks
- 13:00Bug bounty overload
- 14:44Abandoned packages
- 15:46AI fixes vs new issues
- 16:51Dependency updates
- 17:56Cool-down strategies
- 19:40Gossip API solutions
- 21:26Fix-it weeks
- 22:08Summary
- 22:30Q&A
related talks
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
32mAdapting DevOps in a World of Growing Software Supply Chain Attacks
45mPanel Discussion: Managing Open Source...
38mBetter, Faster, Stronger: How the Global Acceleration of OS Development Is Changing
40mDependency Management: The Cause of—and Solution to—All Supply...
37mThe State of Open Source Security
30mOpen Source Malware or a Vulnerability? The Philosophical Debate and How To Mitigate
27mStrangerDanger: Finding Security Vulnerabilities Before They Find You