AI-Powered Threats to the Software Supply Chain

AI-Powered Threats to the Software Supply Chain

Author: Software Engineering Daily August 4, 2026 Duration: 57:21

Open source software underpins virtually every modern application. That ubiquity is a superpower for developers, but it is also an expanding attack surface. Software supply chain attacks were once rare but are now happening daily, with malicious actors exploiting the trust developers place in public registries, package managers, and CI/CD pipelines.

Chainguard is a secure software supply chain platform. The company started with hardened container images and has expanded to cover domains including VMs, language libraries, GitHub Actions, and agent skills.

Matt Moore is a co-founder and CTO of Chainguard, and a veteran of Google’s open source, container, and security infrastructure work. In this episode, Matt joins Gregor Vand to discuss lessons from recent supply chain attacks, why CI/CD pipelines are now a primary attack surface, the challenge of meaningful software inventories, the EU Cyber Resilience Act, and what the arrival of Anthropic’s Mythos model means for the pace of vulnerability discovery and the urgency of patching at machine speed.

Sponsorship inquiries:
sponsor@softwareengineeringdaily.com

The post AI-Powered Threats to the Software Supply Chain appeared first on Software Engineering Daily.


Dive into the vast Podcast Archives-Software Engineering Daily, a curated collection of in-depth technical conversations that have defined the landscape of modern software development. This archive goes beyond surface-level news, offering a permanent record of deep-dive discussions with engineers, researchers, and founders who are building the tools and platforms shaping our digital world. Each episode is a focused exploration, unpacking complex topics like distributed systems, machine learning infrastructure, programming language design, and the practical challenges of scaling technology. You'll hear firsthand accounts of architectural decisions, post-mortems on system failures, and thoughtful debates on emerging paradigms. It’s a resource built for the curious professional who values substance over soundbites, providing context and depth that shorter formats simply cannot. Whether you're looking to understand the historical context behind a current technology, reinforce your foundational knowledge, or discover niche specialties, this podcast archive serves as an essential, ever-growing library. The conversations are detailed, technical, and assume a level of familiarity with the field, making it a trusted companion for continuous learning. Listen to this podcast not for fleeting headlines, but for the enduring insights and nuanced expertise that come from thoughtful, long-form dialogue with the people writing the code and designing the systems that run our world.
Author: Language: en-us Episodes: 50

Software Engineering Daily
Podcast Episodes
Hype and Reality of the AI Coding Shift [not-audio_url] [/not-audio_url]

Duration: 57:05
AI coding tools have gone from novelty to core infrastructure in under three years. Today, many devs use AI daily, a substantial share of new code is AI-generated, and expectations for automation are rapidly increasing.…
Unlocking the Data Layer for Agentic AI with Simba Khadder [not-audio_url] [/not-audio_url]

Duration: 49:04
AI agents are increasingly capable of reasoning and performing autonomous work over long periods. However, as agents take on more complex, longer-horizon tasks, keeping them supplied with the right information becomes th…
Agentic Mesh with Eric Broda [not-audio_url] [/not-audio_url]

Duration: 47:23
AI agents are evolving from individual productivity tools into distributed systems components inside enterprises. The next frontier is coming into focus, and it involves large-scale ecosystems of collaborating agents emb…
New Relic and Agentic DevOps with Nic Benders [not-audio_url] [/not-audio_url]

Duration: 46:18
Observability emerged from the need to understand complex software systems, and involves tracking metrics, logs, and traces so engineers can detect and diagnose problems before they affect users. However, modern applicat…
Mobile App Security with Ryan Lloyd [not-audio_url] [/not-audio_url]

Duration: 54:52
Mobile apps have become a primary interface for critical services, including banking, payments, and healthcare. Unlike web applications, much of the logic and intellectual property in a mobile app lives directly on the u…
FastMCP with Adam Azzam and Jeremiah Lowin [not-audio_url] [/not-audio_url]

Duration: 1:06:06
The Model Context Protocol, or MCP, gives developers a common way to expose tools, data, and capabilities to large language models, and it has quickly become an important standard in agentic AI. FastMCP is an open source…
SED News: OpenCode, AI Code vs. Shipped Code, and the LiteLLM Breach [not-audio_url] [/not-audio_url]

Duration: 56:42
SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer unpack the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry. In this epis…
FreeBSD with John Baldwin [not-audio_url] [/not-audio_url]

Duration: 1:03:31
FreeBSD is one of the longest-running and most influential open-source operating systems in the world. It was born from the Berkeley Software Distribution in the early 1990s, it has powered everything from high-performan…
Cilium, eBPF, and Modern Kubernetes Networking with Bill Mulligan [not-audio_url] [/not-audio_url]

Duration: 57:30
Modern cloud-native systems are built on highly dynamic, distributed infrastructure where containers spin up and down constantly, services communicate across clusters, and traditional networking assumptions break down. L…