Exploits Now Beat Patches: Open Source Security in the AI Era - Patrick Smyth, Chainguard
Patrick Smyth of Chainguard examines how frontier AI has compressed the time between vulnerability disclosure and exploitation, leaving 30-day remediation cycles obsolete. The talk covers AI-assisted attacks, waves of supply chain malware, four attack surfaces spanning malware, known CVEs, zero days, and side doors like CI/CD, developer laptops, and agent skills, and practical defenses including cooldown periods, faster CVE remediation, and signing artifacts with SLSA and Sigstore.
Frontier AI has raised the capability ceiling for attackers. Work that once required a skilled team can now be done by one person with AI tools, from writing scripts and picking targets to organizing files and drafting ransom notes. Recent incidents include a teenager who used an AI chatbot to exfiltrate roughly 4.4 million records from a large internet cafe chain, and an unidentified actor who used an AI coding tool to attack 17 organizations spanning healthcare, government, and major corporations. The useful mental model is that every attacker moves up a level. A lone individual now operates like a team, and a team now operates like an advanced persistent threat.
Exploits now land before patches
Mandiant’s M-Trends data shows the timing gap between patches and exploitation has inverted. In 2018 and 2019 the average patch-to-exploit gap was about 63 days, and it tightened steadily through 2021 to 2023 as a long secular trend in software adoption played out. The trend then reversed, and the average is now negative 70 days, meaning exploits arrive roughly ten weeks before a fix exists.
The traditional response, scanning with tools such as Grype and Trivy, produces CVE lists rated from critical to low that flow to remediation teams on a fixed cadence. That model assumed a 30-day remediation window was reasonable. Against attackers who exploit known vulnerabilities almost immediately and increasingly discover new ones through frontier models, a 30-day cadence no longer protects anyone.
A wave of supply chain malware
Shai-Hulud, a self-propagating worm that began in the JavaScript ecosystem, demonstrated that a worm could spread at scale. It has since spawned a crowd of copycats, including variants like Sandworm mode. Trivy, a widely used security scanner, was itself compromised. In March, three other major attacks landed in a single month. The axios compromise was live for only two hours but still reached around 600,000 downloads.
These attacks chain together because every project depends on other projects’ dependencies. Compromising one maintainer quietly compromises everyone downstream. AI agents accelerate both sides: development teams ship faster, and attackers use the same tools to scale their operations.
The eternal September and the core problem
Early university networks were high-trust communities with strong norms, until each September brought newcomers who did not know the rules and degraded the environment. Software supply chains have undergone the same shift from high trust to low trust, and the pattern now repeats constantly.
The underlying problem is structural. Your users rely on your software and you owe them its security. But you pull code from upstream sources you cannot fully vet, and anything you pull in can compromise both you and your users. Every organization sits between those two obligations.
What to do this year
The immediate actions are cooldown periods for newly published packages, much faster remediation of CVEs, signing of every artifact, and operational security on developer laptops, including physical security keys. Teams that have not finished containerization, CI/CD migration, or golden image programs should treat that work as urgent, because those foundations make the newer modernization efforts far harder without them. AI can help teams leapfrog some of this work, but the baseline now has to be taken seriously.
Four attack surfaces
Malware is the most direct vector, and cooldown periods are the primary defense. Known vulnerabilities remain important even though many CVEs are noise. A minority are genuinely exploitable, and because they are catalogued in public databases, attackers can cross-reference them against an organization’s software with little effort.
Zero days are the most consequential shift. Frontier models are good at chaining together several small weaknesses into a working exploit, which makes the unknown-vulnerability space far more dangerous.
The fourth surface is the set of side doors: CI/CD systems that are often misconfigured and loaded with dependencies, developer workstations that pull packages without any cooldown, emerging agentic layers that people barely understand, and models that can be poisoned. Mac OS stealers and similar tooling have shown how actively attackers are probing these soft targets.
Building the defenses
Chainguard’s approach maps to these surfaces. Its containers ship with no known vulnerabilities, so migrating onto them removes that exposure. Chainguard Libraries are built from source and offered as replacements for PyPI, npm, and Maven Central, which makes many attack paths structurally impossible. For zero days, a consortium of major banks and tech companies shares known zero-day information through a clearinghouse. Hardened drop-in versions of GitHub Actions and third-party agent skills address the CI/CD and agent side doors.
The core iceberg problem is that application code may be only one or two percent of what runs in production. The operating system and language runtime, which hold most of the vulnerabilities, are largely outside an engineering team’s control. Wolfi was built from scratch as a minimal, rolling Linux distribution that is rebuilt one to four times a day, following upstream maintainers closely rather than sitting on stale stable versions. Minimalism also reduces zero-day exposure. The service level commitments are one day for known exploited vulnerabilities, seven days for critical issues, and fourteen days for everything else, a window that most teams never reach for medium and low findings.
Sign everything
SLSA provenance and Sigstore signatures let every artifact be signed at creation and verified at each downstream step, producing a zero-trust pipeline. Many recent attacks target the space between source and distribution, including tags, download pages, and dependencies. Building from source addresses this by taking clean source out of the maintainer’s own infrastructure and building it in a controlled system before distribution.
Hardening agent skills
Analysis of upstream agent skill repositories found that around five percent are actively malicious. That figure was closer to twenty percent earlier in the year, and another 30 to 40 percent carry serious security issues even without malicious intent. Chainguard hardens third-party skills through a pipeline of deterministic and agent-driven checks, and organizations can submit their own internal skills to be hardened and shared across teams.