Episode AI: The Phantom (Dependency) Menace
summary
Endor Labs research shows AI/ML projects often carry phantom dependencies—packages installed at runtime or by scripts that aren’t in manifests—and in 15 customer codebases the heaviest AI adopters see over half their reported vulnerabilities coming from those invisible packages. The practical fix is program analysis that builds call graphs from source/bytecode, correlates what’s on disk with manifests, and produces accurate SBOMs/VEX. Implementations run in CI or cloud, and reliable static techniques push manual uncertainty down to about 5–10% of call paths.
AI-written summary · about
chapters (10)
- 0:00Introduction and speaker background
- 1:40What is AI code and dependencies
- 3:47Why manifest files lie
- 7:12Phantom dependencies in real projects
- 9:21AI code bypassing DevOps
- 11:48Security and compliance risks
- 13:54Program analysis solves the problem
- 18:09Benefits of program analysis
- 19:32Q&A on deployment models
- 22:55Static analysis limitations
related talks
26mSmarter Code, Sneakier Risks: Supply Chain Security in the Age of AI
28mOwn Goal: How AI Agents Are Quietly Scoring for the Other Side
14mAI Sprawl: The Hidden Risk Threatening Your Enterprise Now
34mInvisible Infiltration of AI Supply Chains: Protective Measures from Adversari...
45mDeploy First, Secure Never: AI Between Productivity and Security Chaos
20mThe AI bugpocalypse is here. Now what?
28mScalable Security and Compliance in the Age of AI
28mAI Under the Hood: Unmasking Hidden Threats