Exploits Now Beat Patches: Open Source Security in the AI Era - Patrick Smyth, Chainguard

Patrick Smyth of Chainguard examines how frontier AI has compressed the time between vulnerability disclosure and exploitation, leaving 30-day remediation cycles obsolete. The talk covers AI-assisted attacks, waves of supply chain malware, four attack surfaces spanning malware, known CVEs, zero days, and side doors like CI/CD, developer laptops, and agent skills, and practical defenses including cooldown periods, faster CVE remediation, and signing artifacts with SLSA and Sigstore.