Own Goal: How AI Agents Are Quietly Scoring for the Other Side
summary
JFrog data and incident analysis show real risks: eight packages leaked ~83,000 secrets, 25 packages caused ~2.5 million compromised downloads, npm malicious packages rise ~451%, and researchers find ~969 malicious AI agent skills and an invisible-unicode IDE worm with ~36,000 installs. Risk vectors are packages pulled silently by agents, unmanaged IDE extensions and MCP servers, and misrated CVEs. Recommended actions are automated pre-evaluation and blocking of incoming packages, SBOM-backed contextual vulnerability analysis, and continuous audit-ready tooling.
AI-written summary · about
chapters (7)
- 0:00Introduction to AI risks
- 1:57AI changing code security
- 6:26Malicious AI agent skills
- 11:54Governance gaps in AI tools
- 17:01Future threats and regulations
- 18:33Actionable steps for security
- 22:31Q&A session
related talks
37mAI-Powered Slopsquatting: Is Your Software Supply Chain Compromised?
38mThe Risks of Blind Trust in Code from Strangers
33mSecuring the AI Surge
36mUsing AI to Discover Silently Patched Vulnerabilities in Open...
56mHidden Risks in Open-Source Code and AI Models
01h 02mInside Today’s AI-Accelerated Software Supply Chain Attacks
36mThe Dark Side of AI: The Hidden Risks in Open-Source AI Models
23mVibes Not Vulns: Securing the Era of AI-Written Software