AI-Powered Threats to the Software Supply Chain

Aug 4, 2026 by SED Production

Open source software underpins virtually every modern application. That ubiquity is a superpower for developers, but it is also an expanding attack surface. Software supply chain attacks were once rare but are now happening daily, with malicious actors exploiting the trust developers place in public registries, package managers, and CI/CD pipelines.

Chainguard is a secure software supply chain platform. The company started with hardened container images and has expanded to cover domains including VMs, language libraries, GitHub Actions, and agent skills.

Matt Moore is a co-founder and CTO of Chainguard, and a veteran of Google’s open source, container, and security infrastructure work. In this episode, Matt joins Gregor Vand to discuss lessons from recent supply chain attacks, why CI/CD pipelines are now a primary attack surface, the challenge of meaningful software inventories, the EU Cyber Resilience Act, and what the arrival of Anthropic’s Mythos model means for the pace of vulnerability discovery and the urgency of patching at machine speed.

Sponsorship inquiries:
sponsor@softwareengineeringdaily.com

Thanks to our sponsors

This episode is brought to you by:

Endor Labs
You’re shipping faster than ever with AI coding agents. But those agents don’t vet the packages they pull in, and they don’t have security context built in.
AURI by Endor Labs fixes that. It plugs directly into your editor via MCP, catching vulnerabilities, blocking malicious packages, and flagging exposed secrets in real time. No separate tool to switch to. No dashboard to babysit. Security that fits how you actually build.
Teams using AURI see ten times fewer security tickets and six times faster fixes.
Free for developers. Get started at www.endorlabs.com/auri
tigerdata.com
If you’re running Postgres in production, you’ve probably felt the moment analytical queries start fighting your transactional workload. Most teams end up adding a second database and all the pipeline complexity that comes with it.
Tiger Data, creators of TimescaleDB, takes a different approach. We extend Postgres with hybrid row and columnar storage so one table handles both writes and analytical scans. Native Compression cuts storage costs up to 95%. Continuous aggregates keep dashboards live without batch jobs. And it scales to petabytes without you re-architecting.
Companies like Cloudflare, Octave Energy, Schneider, Axpo, and Flowco run production workloads on Tiger Data today.
No stale data. No second system to operate. Just Postgres, managed for you, ready for the workload you’re building toward.Try it free at tigerdata.com
Notion.com/sed
Agents are getting smarter every day. But even the smartest agents get stuck without the right context and the right tools. That’s where Notion comes in.
With the recent launch of Custom Agents, Notion became the collaborative AI workspace where teams and agents work side by side. And now, their new Developer Platform is turning that workspace into infrastructure developers can build on.
Most agent platforms are single-player, making you stand up your own infrastructure just to start. Notion’s Developer Platform flips both. You get primitives to sync any data source in, give your Custom Agents tools that plain MCP can’t deliver, and orchestrate agents like Claude or Codex alongside your team. The CLI authenticates in one line, and Workers run on Notion’s runtime, so there’s nothing to provision.
Because the workspace your team lives in is the same thing you build on, permissions and governance come standard. Write your code, deploy, done.
Learn more about Notion’s Developer Platform today at notion.com/sed
That’s all lower-case letters — notion.com/sed — to try Notion’s Developer Platform today. And when you use our link, you’re supporting our show!
Notion.com/sed

Endor Labs

tigerdata.com

Notion.com/sed

Subscribe to the newsletter

Related episodes

Subscribe
to the newsletter