Supply chain security

Oct 11, 2026

AI Security Engineer Foundations + Certificate — Javier Garza, Snyk

Javier Garza's AI Security Engineer Foundations workshop walks through the OWASP LLM Top 10, shadow AI and AI Bills of Materials, AI threat modeling, securing agent skills and MCP servers, secure vibe coding, and offensive agent workflows. Throughout, he argues that AI systems break traditional security assumptions because they are probabilistic, reach external content, and act through tools, so defenses must combine least-privilege access, continuous inventory, automated scanning, human approval, and education that explains guardrails rather than merely imposing them.

Sep 14, 2026

We let an AI agent execute Bash and lived to talk about it — Sarah Sanders, PostHog

Sarah Sanders, a context engineer at PostHog, discusses the security implications of building an agentic CLI tool, "The Wizard," which automates developer workflows. She highlights the inherent risks of agents capable of executing commands, labeling it a "malware starter pack," and details how PostHog evolved its security posture from basic allow lists to a sophisticated "defense in depth." Key insights include the principle that "attacks compose, code review doesn't," the discovery of internal supply chain vulnerabilities through the "Context Mill," and the development of "The Warlock," a deterministic scanner using YARA rules. Sanders emphasizes the critical distinction between deterministic enforcement and probabilistic judgment, explaining how an LLM-powered "Triage" layer acts as an adviser (failing closed) rather than a bouncer, preserving the integrity of their security model.

Sep 09, 2026

Why won’t AI agents just follow the rules?

This podcast episode tackles critical cybersecurity issues in AI, examining why AI agents defy rules and the necessity of deterministic external controls. It highlights the severe lack of security in agentic skill marketplaces (OWASP Top 10), where "natural language is executable" and the "rush to market" overlooks basic hygiene. The discussion also covers how AI disrupts bug bounties, leading to lower payouts and "AI slop" reports, potentially pushing researchers to the dark market. Finally, it introduces ThreatXtension, an AI-powered open-source tool to detect malicious browser extensions.

Aug 07, 2026

Open Source Is Dead. Long Live Open Source. — Saoud Rizwan, Cline

Saoud Rizwan, founder of Cline, discusses how AI has eroded trust in open-source communities, leading projects like Zig and curl to restrict AI-generated contributions and exposing severe supply chain risks, as seen with the litellm compromise. He argues that while community open source is struggling, the economic imperative of "open weights" models is rising. Citing the high costs of closed LLMs and the success of models like GLM at Coinbase, Rizwan draws parallels to the Open Compute project, predicting a commoditization of AI inference. He urges American labs to release open-weights models to maintain technological leadership against foreign competitors and prevent lock-in.

Jul 17, 2026

The Great Loops Debate — Dex Horthy, Geoff Huntley, Ian Livingstone, Greg Pstrucha, @insecure-agents

An Oxford-style debate exploring the gap between the hype and practical reality of "loops" in AI/ML development. Experts discuss their history, optimal anatomy, future role in software factories, and challenges like security, economic viability, and the imperative for strong engineering discipline.

Jul 01, 2026

The new post-quantum cryptography executive order. Plus: What is Q-Day, really?

This episode delves into Q-Day, the anticipated future when quantum computers can break public key cryptography, and the U.S. Executive Order accelerating the transition to post-quantum cryptography. Experts discuss why Q-Day is a gradual process rather than a sudden event, the critical importance of "crypto-agility" as a long-term strategy, and the necessity for organizations to begin immediate discovery and planning to secure data against "collect now, decrypt later" threats. The discussion also touches upon the broader, transformative benefits of quantum computing beyond just security.