The Video Signal

Topic

Supply Chain Security

All digests tagged Supply Chain Security

We let an AI agent execute Bash and lived to talk about it — Sarah Sanders, PostHog thumbnail

· 21:00

We let an AI agent execute Bash and lived to talk about it — Sarah Sanders, PostHog

The talk details the architecture and security challenges of building agentic CLI tools, exemplified by PostHog's 'Wizard.' The speaker emphasizes that an agent with command execution capabilities is essentially a 'malware starter pack.' Security must be layered, deterministic, and must account for dangerous inputs originating not only from users but also from the system's own supply chain (the 'Context Mill'). The solution involves implementing a dedicated, deterministic scanner (Warlock) and ensuring that the LLM layer acts only as an 'adviser,' never an enforcer.

Key takeaways

  1. The Danger of Agentic Tools 0:03

    An agent that can run commands is structurally similar to malware, requiring extreme caution. The threat model must account for how 'attacks compose' from multiple, seemingly innocent vulnerabilities.

  2. Context Supply Chain Risk 0:11

    The most dangerous input can come from the system's own supply chain (the Context Mill), such as a seemingly harmless prompt injection payload signed by the development team.

  3. Security Must Be Deterministic 0:15

    For enforcement, security mechanisms must be deterministic and mechanical. The LLM layer should only be an 'adviser' to reduce noise, never the primary enforcer, to prevent failure modes.

Watch on YouTube Full article

AAIF Reading Group - Prompt Injection as Role Confusion: Rethinking Agent Security thumbnail

· 55:36

AAIF Reading Group - Prompt Injection as Role Confusion: Rethinking Agent Security

This reading group explores Prompt Injection through the lens of 'Role Confusion,' arguing that the vulnerability stems from the model's inability to strictly isolate roles (User, System, Tool, Thought). Speakers detail advanced attack vectors, including forging chain-of-thought reasoning and exploiting model style, which significantly increases attack success rates (ASR). Mitigation strategies discussed include implementing instruction hierarchies, sandboxing environments, and ensuring robust access controls, particularly when dealing with smaller or less state-of-the-art (SOTA) models.

Key takeaways

  1. Role Confusion as the Core Vulnerability 18:20

    The core claim is that prompt injection is a problem of role confusion, where the model treats fabricated reasoning (e.g., forged chain-of-thought) as its own internal thought process, rather than recognizing it as external input. This allows attackers to mislead the model into following harmful instructions.

  2. Advanced Attack Vectors 20:00

    Attackers can increase ASR by injecting fabricated reasoning (forged thought) or by exploiting the model's style. One study showed that injecting forged chain-of-thought increased the ASR from 0% to 94% for OpenAI models.

  3. System-Level Security Risks 30:00

    Security risks extend beyond prompts to system components. Examples include exploiting API calls (e.g., Anthropic's Opus 4.8) by injecting encrypted tokens/signatures from a smaller model (Haiku), and supply chain attacks (e.g., the LightLM incident) where malicious packages are introduced via open-source frameworks.

  4. Mitigation through Design 38:20

    Proposed solutions include implementing 'instruction hierarchies' (prioritizing roles) and running models in isolated, sandboxed environments. The speakers emphasized that security must be baked into the design, not just added as a patch.

Watch on YouTube Full article

The OWASP LLM Top 10 has a few surprises for you thumbnail

· 29:05

The OWASP LLM Top 10 has a few surprises for you

The discussion analyzes emerging risks in AI security, highlighting a shift from focusing solely on prompt manipulation to addressing 'Excessive Agency'—the actions an autonomous system can perform. Key takeaways include the need for robust identity controls (least privilege, segmentation) when dealing with agentic systems and the necessity of operationalizing supply chain data via CISA's updated SBOM guidance. Experts emphasize that security must be built around AI models to ensure resilience when they inevitably fail.

Key takeaways

  1. Shift in AI Risk Focus: Agency over Injection 20:55

    The primary concern is shifting from manipulating what the AI says (prompt injection) to controlling what it actually does (excessive agency). Agents are viewed as privileged accounts that require strict identity and access controls.

  2. OWASP List for Tabletop Exercises 21:05

    Instead of treating the OWASP LLM Top 10 list as a compliance checklist, panelists recommend using it as a framework for tabletop exercises to test detection, containment, and reconstruction capabilities during an attack.

  3. Operationalizing SBOM Data 21:45

    CISA's updated SBOM guidance (2026 minimum elements) must move beyond being a compliance artifact. Organizations must integrate SBOM data with vulnerability/exposure management to determine *where* and *how* critical components are exposed in real-time, rather than just cataloging them.

  4. AI Agents as the New Attack Surface

    The risk is no longer limited to software vulnerabilities; AI agents themselves constitute a new attack surface. Threat actors can exploit an agent's granted authority (e.g., via malicious calendar invites) through techniques like 'Intent Collusion.'

Watch on YouTube Full article

Open Source Is Dead. Long Live Open Source. — Saoud Rizwan, Cline thumbnail

· 17:30

Open Source Is Dead. Long Live Open Source. — Saoud Rizwan, Cline

The speaker argues that while traditional open source community models are struggling due to AI-driven skepticism and supply chain risks, the future of software development lies in 'open weights' models. The economic imperative is shifting away from raw intelligence toward cost efficiency and standardization. Examples like the compromise of the Litellm package and the comparison between GLM and Opus demonstrate that open weights models can achieve production-grade results at a significantly lower cost, mirroring historical commoditization events like Open Compute.

Key takeaways

  1. Open Source Trust Crisis 2:05

    The community trust model is eroding. Examples include Zig banning AI use in PRs/issues to protect contributors, curl considering ending its bug bounty program due to AI-generated reports, and tldraw automatically closing pull requests. GitHub even shipped a feature to disable third-party PRs altogether. (0:38)

  2. Supply Chain Risk Highlighted by Litellm Attack 7:00

    The Python package litellm (3.5 million daily downloads) was compromised for three hours, installing a credential harvester to steal API keys, SSH keys, and crypto keys, along with a remote command execution backdoor. The attack was only caught due to a bug in the malware that crashed Cursor. (4:20)

  3. Open Weights Models Drive Cost Efficiency

    Testing showed GLM outperformed Opus on a real client bug by cleaning up dead code and confirming compilation, even though it used twice the tokens, because its cost was half that of Opus. This demonstrates that cost efficiency is becoming more critical than raw speed or intelligence. (13:05)

  4. The Open Compute Precedent

    Facebook's decision to open source its data center designs led the entire supply chain to standardize on those schematics, commoditizing components and driving down costs for all participants, including Facebook itself. (16:20)

Watch on YouTube Full article

Joseph Katsioloudes - Code Security Reinvented: Navigating the era of AI - AI Native DevCon June 26 thumbnail

· 35:18

Joseph Katsioloudes - Code Security Reinvented: Navigating the era of AI - AI Native DevCon June 26

AI is revolutionizing code security by helping minimize the gap between developers and dedicated security specialists. While AI tools like GitHub Copilot can significantly improve detection and, more critically, the speed of fixing vulnerabilities (the 'fixing problem'), they are not a replacement for human oversight. Responsible adoption requires utilizing structured protocols like Model Context Protocols (MCPs) and implementing agentic workflows within CI/CD pipelines to ensure deterministic, auditable, and context-aware security checks.

Key takeaways

  1. AI's Role in Security Gap Reduction 18:04

    The primary opportunity is using AI to scale scarce security expertise. While traditional static analysis tools (like CodeQL or Semgrep) are excellent for pattern matching, AI excels at modeling complex behavioral and contextual issues that pass standard checks.

  2. AI Limitations: Hallucinations & Non-Determinism 4:00

    The speaker notes that while AI is powerful, it should not be the sole safety net; good security hygiene remains paramount.

  3. Leveraging MCPs and Skills 22:20

    Model Context Protocols (MCPs) allow AI models to access server-side information from trusted sources (e.g., GitHub Security Lab findings), extending the context beyond narrow training data. Combining MCPs with structured 'skills' ensures that automated fixes are auditable, maintainable, and integrated into development processes.

  4. Agentic Workflows for CI/CD 27:00

    Agentic workflows allow security agents to run on a schedule or trigger automatically. They can perform sophisticated tasks, such as running manual security reviews automated by AI (using quantified knowledge from research) and proposing fixes directly within the Pull Request (PR), accelerating the fix rate.

Watch on YouTube Full article