AI-Powered Threats to the Software Supply Chain

AI-Powered Threats to the Software Supply Chain

Author: Software Engineering Daily August 4, 2026 Duration: 57:21

Open source software underpins virtually every modern application. That ubiquity is a superpower for developers, but it is also an expanding attack surface. Software supply chain attacks were once rare but are now happening daily, with malicious actors exploiting the trust developers place in public registries, package managers, and CI/CD pipelines.

Chainguard is a secure software supply chain platform. The company started with hardened container images and has expanded to cover domains including VMs, language libraries, GitHub Actions, and agent skills.

Matt Moore is a co-founder and CTO of Chainguard, and a veteran of Google’s open source, container, and security infrastructure work. In this episode, Matt joins Gregor Vand to discuss lessons from recent supply chain attacks, why CI/CD pipelines are now a primary attack surface, the challenge of meaningful software inventories, the EU Cyber Resilience Act, and what the arrival of Anthropic’s Mythos model means for the pace of vulnerability discovery and the urgency of patching at machine speed.

Sponsorship inquiries:
sponsor@softwareengineeringdaily.com

The post AI-Powered Threats to the Software Supply Chain appeared first on Software Engineering Daily.


Every day, the world of technology evolves, and Software Engineering Daily provides a crucial, in-depth look at how that happens. This podcast sits at the intersection of code, infrastructure, and the people who build it, offering long-form conversations that go far beyond surface-level news. Each episode features a detailed technical interview with engineers, founders, and researchers who are actively shaping the landscape. Listeners will hear concrete discussions about system design, programming languages, DevOps practices, and the architectural decisions behind major platforms. The focus is on the how and the why-the practical challenges and trade-offs faced by professionals in the field. It’s a resource for developers seeking to understand not just what tools to use, but the underlying principles that make them effective. By dedicating time to a single topic per episode, the podcast allows for a thorough exploration that is both educational and genuinely insightful. Tune in for a consistent and substantive dive into the mechanics of modern software, where every conversation is an opportunity to deepen your technical understanding and stay engaged with the pulse of the industry.
Author: Language: en-us Episodes: 50

Software Engineering Daily
Podcast Episodes
Scaling Agent Workloads at Vercel [not-audio_url] [/not-audio_url]

Duration: 51:25
Most AI agent setups today are built around a single session, where one user interacts with one agent at a time. However, that model breaks down when an agent has to serve a business, where thousands of requests can arri…
Inside Google’s Database Infrastructure for the AI Era [not-audio_url] [/not-audio_url]

Duration: 1:18:26
Historically, databases were responsible for storing data and returning exact results in response to queries. However, AI is now bending that contract in a new direction. Applications increasingly expect structured and u…
A Rust Framework to Simplify Distributed Systems [not-audio_url] [/not-audio_url]

Duration: 50:31
A Rust Framework to Simplify Distributed Systems Building software that runs across many machines is notoriously difficult. Developers have to grapple with problems such as race conditions, partial failures, and message…
Moving Beyond RAG with Precomputed Context [not-audio_url] [/not-audio_url]

Duration: 55:48
Retrieval has become one of the central problems in building useful AI systems. The standard approach to grounding a model in one’s own data has been retrieval augmented generation, or RAG, where an agent searches a vect…
The Death of Online Anonymity [not-audio_url] [/not-audio_url]

Duration: 52:42
Age verification is reshaping how people access the internet. An ever-growing patchwork of laws can now require government IDs, facial age estimation, or behavioral inference before you can enter digital spaces. Discord,…
TypeScript 7 and What Comes Next [not-audio_url] [/not-audio_url]

Duration: 57:15
TypeScript is a programming language that builds on JavaScript by adding a system of types. Those types let developers describe the shape of their data and catch mistakes before code ever runs, while also powering the au…
The Gap Between AI Spending and AI Value [not-audio_url] [/not-audio_url]

Duration: 54:42
It is widely reported that a gap has emerged between enterprise spending on AI and the durable value captured from that spend. Individual employees have enthusiastically adopted coding assistants and chatbots, yet those…
AI and the New Global Security Landscape [not-audio_url] [/not-audio_url]

Duration: 1:12:32
The conversation about AI often focuses on software, automation, and the race between attackers and defenders in code. However, some of the most consequential risks lie further afield, in domains where a mistake is measu…
How LLMs Are Reshaping Recommendation Systems [not-audio_url] [/not-audio_url]

Duration: 47:51
News feeds and recommendation systems have long relied on deep learning architectures that score each candidate item independently. As LLMs have matured, they have opened up a fundamentally different approach, where a sy…