Risky Biz Podcast: AI Agents Are Raising the Stakes for Software Supply Chain Security

Over the past six months, the open source ecosystem has faced an unprecedented wave of software supply chain attacks, with attackers compromising widely used packages and exploiting trusted developer workflows. This surge in attacks coincides with the rise of AI coding agents, which transform software development by rapidly introducing dependencies and making trust decisions without thorough context. This combination amplifies the challenges for teams relying on open source software, as traditional security tools often fail to detect malicious packages. In a discussion with Patrick Gray, Socket founder and CEO Feross Aboukhadijeh highlights these issues and introduces Socket Firewall as a solution that blocks malicious packages and code extensions before they reach developers. Socket Firewall can be integrated as a package manager wrapper, in CI, or as a network proxy for internal package registries. While AI complicates the supply chain problem by accelerating risk, it also offers defenders new capabilities to review open source code at an unprecedented scale.

No tracked trend matches for this post yet.