Andrew Martin - State of the GenAI Supply Chain: Slopsquatting and Secure OSS Demystified

Open source is under assault. Expansive AI vulnerabilities and supply chain attacks, targeted maintainers, and frontier models from nation state adversaries bring us to ask: is open source software safe to use? The contract is clear: free, zero-liability software wins on merit; the commons is the greatest marketing engine in software; and we can develop transferrable skills between our employers. But how can we do so without getting hit by an AI-enhanced zero day attack? In this talk, we: - analyze and classify recent and historical open source AI attacks - threat model the OSS supply chain - use CNCF and OpenSSF security tooling to reduce our risk - design systemic controls to secure the use of open source in today's climate