Patrick Smyth discusses how AI tools may accelerate attacks and cites Mandiant data on exploitation and patch timelines. He describes supply chain malware incidents and the risk of compromised upstream dependenciesSoftware supply chain security protects the dependencies, tools and delivery processes used to build and distribute software, including AI applications..
He distinguishes malicious packages, known vulnerabilities, previously unknown vulnerabilities and softer targets such as CI/CD, developer machines and agent skills. His suggested priorities include faster remediation, package cooldowns and signed artifacts.
Smyth describes Chainguard’s approach to rebuilt packages, minimal containers, provenance and hardened CI/CD actions and agent skills. His claims about the prevalence of malicious skills and product capabilities are presented as his assessment.
Watch on YouTube
