As software development accelerates with the rise of autonomous agents and “Agentic Vibe Coding”, the introduction of vulnerabilities into codebases is scaling correspondingly. While Artificial Intelligence and Large Language Models (LLMs) act as proficient developers, they are frequently trained on potentially insecure data from unverified platforms like GitHub and HuggingFace, making them susceptible to data poisoning and prone to generating insecure code patterns. Furthermore, LLMs do not inherently prioritize using the most secure or updated versions of dependencies, which leaves freshly generated "vibe coded" software vulnerable to zero-day attacks. In this security in practice talk we showcase the challenges we faced over the years in our transition to a DevSecOps model and demonstrate why automated Software Composition Analysis (SCA) and Static Application Security Testing (SAST) in CI pipelines are still foundational to a modern secure coding approach. We explain how proactive controls can be used to scan new code in CI for vulnerable dependencies and implementation-level weaknesses through before merging into production. We show how Reactive controls continuously assess the full codebase so that newly disclosed vulnerabilities are detected after code has already shipped. We then proceed to outline how specific risks introduced by LLMs, such as generating code that violates secure-coding best practices and introduces vulnerable dependencies, can be initially tackled with such a traditional approach, but how this strategy falls short when the scale and speed of development do not align with traditional human review processes and alerting fatigue. To mitigate these threats, we showcase the blueprint for an agentic security pipeline augmented with deterministic SARIF reports guiding LLMs to behave like security-conscious developers and using an “LLM as a Judge” approach to reduce false-positive fatigue. Ultimately, this session emphasizes that security must shift left to the point of generation, ensuring that AI-driven development is constrained by strict automated guardrails rather than blind trust.
Senior Application Security Engineer, Open Systems AG
Luca Galli, PhD, is a Senior Application Security Engineer II at Open Systems, where he specializes in application security, DevSecOps, and AI security. He drives the protection of complex multi-language monorepos and leverages AI to automate security pipelines, streamlining vulnerability... Read More →
Tuesday October 6, 2026 10:40 - 11:00 CEST South Hall 3A
Spracklen et al. (USENIX Security '25) showed that code-generating large language models hallucinate package names that do not exist on PyPI or npm at rates ranging from 5.2% on commercial models to 21.7% on open-source models, creating an attack surface for slopsquatting—the registration of malicious packages under hallucinated names. We replicate their methodology on five frontier code-capable LLMs released between October 2025 and March 2026: Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2. Across 199,845 paired Python and JavaScript prompts validated against PyPI and npm master lists, we measure overall hallucination rates between 4.62% (Claude Haiku 4.5) and 6.10% (GPT-5.4-mini)—an order-of-magnitude compression of the inter-model spread observed by Spracklen, but not a retirement of the threat. Beyond replication, we identify a set of 127 package names (109 on PyPI, 18 on npm) that all five evaluated models invent identically; following coordinated disclosure with PyPI Security and Socket.dev, 53 of these (41 on PyPI, 12 on npm) remain registrable by an attacker after each registry's existing defenses, constituting a model-agnostic supply-chain attack surface that no single-model study can reveal. We further document a Python-over-JavaScript hallucination asymmetry that inverts Spracklen's 2024 finding, identify a Haiku-below-Sonnet inversion within the Anthropic family, and observe a Jaccard-similarity peak between DeepSeek V3.2 and GPT-5.4-mini (J = 0.343) suggestive of shared training-data origins.
Aleksandr Churilov is an independent security researcher working on the safety of LLM-based systems, with a focus on the supply-chain and agent-security failure modes that appear as models move into real developer workflows. His recent work replicated and extended the measurement... Read More →
Tuesday October 6, 2026 11:02 - 11:20 CEST South Hall 3A
Tool-augmented Large Language Model (LLM) agents create a new supply-chain surface: Model Context Protocol (MCP) tools are installed like third-party packages, yet their outputs can enter the agent’s reasoning context. This enables confused-deputy risks in which attacker-controlled semantic supply-chain inputs cause otherwise benign tools to exercise legitimate authority over files, environment variables, or network-facing operations and reflect sensitive or instruction-like content into LLM-visible fields. We present SandScope, an MCP-aware audit framework that combines runtime witness detection with semantic tool profiling. SandScope executes portable tools under WebAssembly (WASM) System Interface (WASI) or drives unmodified MCP servers over standard input/output (stdio), extracts LLM-visible sinks from tool results and prompt/message fields, and reports auditable source-to-sink witnesses from environment, file, and tool-input sources while separately recording network-intent and egress evidence. Its semantic layer recovers declared capabilities from tools/list metadata and static registrations to characterize attack surface when execution is incomplete. We evaluate SandScope on controlled cross-language subjects, an evasion benchmark, and a 100-repository MCP corpus. SandScope achieves high controlled accuracy (0.941 F1) with no false positives, completes shallow dynamic scans for 38.5% of resolved real-world repositories, and extends visibility through semantic profiling to 71% of the corpus. Among recovered tools, 78.6% declare at least one security-sensitive capability. For shallow-scan successes, schema-guided exploration re-executes 94.3% and observes source-to-sink witnesses in 36.4% of re-executed repositories. These results show that SandScope provides practical, auditable evidence for MCP tool risk through controlled execution, MCP-aware sink extraction, runtime witness reporting, and semantic capability profiling.
Zhuoran (Newt) Tan is a security researcher specialising in AI/LLM security, software supply chain security, and runtime threat detection. He recently completed his PhD in Computing Science at the University of Glasgow, where his research focused on runtime observability and security... Read More →
Tuesday October 6, 2026 11:22 - 11:40 CEST South Hall 3A
Supply chain attack campaigns mass-produce their artifacts, and mass production leaves a structural trace: hundreds of near-identical files. In AI agent skill marketplaces, which distribute capabilities as natural-language instruction files following the Agent Skills standard (an open format adopted by over 30 platforms), the artifact carrying that trace is a document, readable by document similarity alone. No marketplace examined in this study performs documented deduplication or similarity checking at ingest. In early 2026, threat actors uploaded hundreds of skills to the ClawHub registry for the OpenClaw agent framework, directing users to install credential-stealing malware.
Gale Fagan is a Principal AI Architect at Brightflag, a Wolters Kluwer legal-tech company. Over nearly thirty years, she has held engineering, architecture, and executive roles at Apple, Uber, HashiCorp, Nervana (later Intel), dv01, and ISC, where she helped keep f.root-servers.net... Read More →
Tuesday October 6, 2026 11:42 - 12:00 CEST South Hall 3A
Machine learning models are increasingly distributed through centralized repositories such as Hugging Face. These models rely on a variety of serialization formats and on complex software libraries for deserialization. This introduces risks into the supply chains of applications using those models as deserialization is prone to vulnerabilities. In this paper, we study and quantify this risk by conducting a large-scale empirical study of model serialization formats used in the Hugging Face ecosystem. We analyze a snapshot of 10,000 models on Hugging Face across 39 time points (56,533 models in total) and study the prevalence of 41 serialization formats.
Software supply chain security is rapidly building its own risk-management toolbox: software bills of materials (SBOMs), provenance and build-integrity frameworks such as SLSA, dependency graphs, and repository-health scorecards. Physical supply chain risk management (SCRM) has spent decades developing structurally similar instruments, including multi-tier visibility programs, criticality and single-source analysis, cascading-failure and disruption-propagation models, supplier audits and ratings, and standards such as ISO 28000 and ISO 31000. Yet the two literatures remain almost entirely disconnected, and the software security community risks re-deriving known results, repeating documented failures, or overlooking mature methods that could transfer. This paper systematizes knowledge across both fields. We place physical SCRM methods and software supply chain security mechanisms in a common risk-management reference frame spanning risk identification, assessment, mitigation, and monitoring, and construct an explicit mapping between the two, for example bill of materials and SBOM, supplier audit and attestation, tier visibility and transitive dependency depth. For each physical-side method we assess whether it transfers directly, transfers with adaptation, or fails to transfer, identify one transfer that runs in reverse, and analyze why, drawing on structural differences such as the zero marginal cost of software replication, adversarial rather than predominantly stochastic disruptions, and dependency graphs of far larger scale and faster dynamics. From this analysis we derive a research agenda identifying which validated SCRM instruments are ready for evaluation in software ecosystems and where software-native methods are genuinely required.
Most organizations that consume open-source software remain reactive when assessing component security risk. CVE disclosures, CVSS severity scores, and EPSS exploit predictions are valuable, but they generally become useful only after a vulnerability has already been discovered and publicly disclosed.
Tim Brennan is a Principal Software Engineer at Raytheon, an RTX business, with 30 years of experience in software engineering. He is also a Doctor of Engineering candidate in Cybersecurity Analytics at The George Washington University, where his praxis research developed CANARY... Read More →
Tuesday October 6, 2026 13:55 - 14:15 CEST South Hall 3A
Python has become the default language for interacting with AI, with packages being distributed through registries like the Python Package Index (PyPi). This creates a need to analyse supply chains comprising such packages. One such analysis is to rebuild packages in order to identify compromised builds injecting malware. Independent rebuilds in hardened environments have the added advantage that they can generate and record provenance in order to increase the trustworthiness of packages. Two tools that are designed to automate such rebuilds and run them at scale are macaron and oss-rebuild. We study 12,180 popular releases from pypi and find that the byte-for-byte equivalence rate is generally low. We analyse the reasons why they produce different wheels, and find that equivalence between the original and rebuilt wheels can often still be established, preserving most of the guarantees users expect from rebuildable releases. We present and evaluate daleq4py, a tool to establish the equivalence of Python wheels through the kernel of a normalisation function that is based on provenance-preserving datalog rules. Experimental results show that daleqpy substantially expands the set of rebuilds that can be accepted as equivalent. Although only 15.4% of macaron rebuilds and 19.1% of oss-rebuild rebuilds are byte-for-byte identical to the published PyPi wheels, daleq4py establishes wheel equivalence for 60.2% and 78.9% of source-equivalent rebuilds, respectively.
Jens is an Associate Professor in the School of Engineering and Computer Science (ECS) at Victoria University of Wellington in Wellington, New Zealand. He has a Master in Mathematics and a PhD in Computer Science from the University of Leipzig in Germany. After graduating in 1996... Read More →
Tuesday October 6, 2026 14:17 - 14:35 CEST South Hall 3A
Setting a minimum release age is a new feature of npm, pnpm, Yarn, and other package managers, introduced to provide a mechanism for mitigating the impact of malware being uploaded to npm. However, no evidence-based analysis has been performed to determine how this security mechanism should be tuned to make effective use of it. To close this gap, we analyze the GitHub Advisory Database to collect data on the timeline of malware detection. Building upon prior work on measuring malicious package detection and popularity-weighted impact, we combine historical malicious package detection and npm download metrics to estimate minimum release age thresholds that can provide developers with confidence that updated releases contain no malicious code. To our knowledge, we are the first to provide evidence based recommendations for setting the recently introduced minimum release age feature. By conducting this study, we hope to provide real world benefits to developer security. Based on our study of malware detection time using the GitHub Advisory Database, we find that a general recommendation of setting the minimum release age to 8 days provides significant security benefits with little to no negative impact on developers.
Dominic is a PhD student in Computer Science at the University of Kansas's Institute for Information Sciences. His research explores programming language ecosystems and software supply-chain security, particularly within npm. He previously presented at SCORED '25 on the usage of HTTP(S... Read More →
Tuesday October 6, 2026 14:37 - 14:55 CEST South Hall 3A
Tracking vulnerabilities inherited from third-party open-source software is a well-known challenge, often addressed by tracing the threads of dependency information. At scale, existing approaches precompute the vulnerable versions of software associated with known CVEs, based on declared impacted versions or using local history analysis. However, vulnerabilities can also propagate through forking: a repository forked after a vulnerability is introduced but before it is patched may remain vulnerable long after the original repository has been fixed. Existing history analysis approaches analyze only the repository referenced by the CVE, providing a local view of the ecosystem that excludes forks sharing part of its development history. Vulnerabilities disclosed and patched elsewhere in a fork ecosystem may therefore persist as one-day (known but unpatched) vulnerabilities without fork maintainers’ awareness. This paper proposes a global history analysis approach that conforms to the evaluation semantics defined by the OpenSSF Open Source Vulnerability (OSV) format, while extending them from repository-local histories to the global commit graph of the open-source ecosystem. Leveraging the graph of public code captured by Software Heritage, our approach propagates vulnerability introduction and fix information across shared commit histories and performs automated impact analysis. Starting from 7162 repositories containing vulnerable commits listed in the OSV.dev vulnerability database, we propagate vulnerability information to 2.2 million forks. We evaluate our approach on a sample of 195 ⟨fork, vulnerability⟩ pairs from popular repositories, manually auditing their code and contacting their maintainers for confirmation and responsible disclosure. This process identified 135 high-severity one-day vulnerabilities, achieving a precision of 0.69, with 9 cases confirmed by maintainers.
Romain Lefeuvre is a PhD student in software engineering at the DiverSE team (IRISA, Inria, University of Rennes), supervised by Professor Benoit Combemale. His research explores how diversity, in open-source ecosystems, in software features, and in development processes, impacts... Read More →
Tuesday October 6, 2026 14:57 - 15:15 CEST South Hall 3A
Modern software supply chains have evolved into vast, heterogeneous networks where transparency — the granular understanding of all software components — is now a critical security requirement. While Software Bills of Materials (SBOMs) have emerged as the primary mechanism for this transparency, current industry practices rely on a metadata-centric paradigm that assumes an artifact is defined solely by its package manager declarations. We posit that this assumption is fundamentally flawed, creating a systemic visibility gap we define as Software Dark Matter (SDM). SDM is the set of files present in an artifact's filesystem that are unaccounted for by its associated metadata. We implement a reference tool, DARKFILES, and use it to analyze four ecosystems of disjoint nature: DockerHub, bundling-prone Maven Central artifacts, extension marketplaces (Jenkins plugins and OpenVSX), and a real-world enterprise environment.
Dennis Roellke is a Security Architect in the Office of the CTO at Bloomberg, where he provides strategic advice to the company's software supply chain security program. His influence spans multiple departments within the firm, orchestrating a secure software development lifecycle... Read More →
PhD Researcher, Trustworthy Software Ecosystems Lab, Purdue University
Abhishek Reddypalle is a PhD researcher at Purdue University's Trustworthy Software Ecosystems Lab, where he works on software supply-chain security. His research includes work on reproducible builds and SBOM completeness, with a focus on build-time techniques for producing SBOMs... Read More →
Tuesday October 6, 2026 15:45 - 16:03 CEST South Hall 3A
Practitioners evaluating open-source dependencies rely on cheap trust signals, e.g., stars, download counts, and contributor activity, as substitutes for direct code inspection, assuming those signals reflect genuine trustworthiness. Prior work has documented individual signal gaming, but the landscape of collapses across all dependency-adoption signals, as well as the ecosystem’s response, remains unexplored. The goal of this study is to aid software practitioners in understanding the reliability of dependency adoption trust signals, such as download counts and contributor activity, by conducting a multivocal review of 252 Google Search sources and 870 Reddit threads. After coding the corpora, we find that cheap trust signals collapse under three simultaneous forces: adversarial manipulation, gaming techniques indistinguishable from legitimate behavior, and non-adversarial AI-driven inflation. The documented responses are more advice than actual action: 54.6% of Google Search sources contain advice on what practitioners should do, with no actual action taken. Responses proposed substituting one cheap signal for another or aggregating multiple signals, which are now also gameable. Non-adversarial inflation, i.e., degradation caused by the emergence of legitimate AI tooling, lacks documented actual behavior change in either corpus. The gap between known remedy and actual practice points toward a market for lemons: when faking signals costs less than earning them, good and bad dependencies become indistinguishable. Relying on individual practitioners to verify the cheap signals is not sustainable. Costlier signals, such as cryptographic attestation, should be made mandatory so that they become the default for all, not a voluntary choice for the few.
Ranindya Paramitha is an incoming Lecturer at the University of Bristol, UK. The presented work was completed when she was a Postdoctoral Research Scholar at North Carolina State University, USA. She received her PhD from the University of Trento, Italy. Her research focuses on software... Read More →
Tuesday October 6, 2026 16:04 - 16:22 CEST South Hall 3A
Ken Thompson's trusting-trust attack, in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regarded as a threat specific to compilers. We show that it is not. We construct a complete trusting-trust attack around GNU strip, an ordinary build utility that neither inspects nor generates source code, using only manipulations of finished ELF files. In the bootstrap of the NixOS Linux distribution, a single tampered strip in the binary seed implants a payload that propagates from one generation of strip to the next and survives into the final standard environment after the seed leaves the dependency closure. On a real nixpkgs revision, the attack builds a complete graphical installer without failures and backdoors almost every one of its binaries, enabling arbitrary malicious behavior of the subverted packages.
Aman Sharma is a doctoral researcher at KTH Royal Institute of Technology in Stockholm, where he works on software supply chain security. His research digs into how we can trust the software we depend on. His expertise spans the Maven/Java ecosystem and the broader open-source supply... Read More →
Tuesday October 6, 2026 16:23 - 16:41 CEST South Hall 3A
Modern software relies on a multitude of dependencies, meaning a single compromised library can jeopardize all downstream software. Attackers increasingly exploit this structural weakness, leading to a proliferation of supply chain attacks with severe consequences across the broader software landscape. Recent legislation proposes using SBOMs to address this threat. However, researchers have identified many practical challenges in realizing the security benefits of SBOMs. These challenges underscore the need for a better understanding of the SBOM ecosystem. We address this need with the following four contributions. First, we present and publish a large-scale dataset of real-world SBOMs, comprising 468550 unique SBOMs from 93445 open-source repositories. These SBOMs were either obtained from the GitHub Dependency Graph or self-generated with Syft and Trivy, two well-established open-source SBOM generators. Second, we analyzed the agreement on the dependency sets between these SBOM generators and identified discrepancies. Third, we shed light on how these generators embed dependency structure in their SBOMs. These structures differ significantly, with strong implications for SBOM use cases. Fourth, we evaluated SBOM characteristics against current regulatory guidelines using sbomqs, a widely accepted tool for ascertaining SBOM quality and compliance. For SBOMs generated by different tools, sbomqs indicated varying adherence to these guidelines. Overall, our work provides an open, extensible empirical analysis of the SBOM ecosystem, serving as a knowledge base for establishing best practices for SBOMs to unlock their real-world security benefits.
Doctoral Candidate, Technical University of Munich
Lukas Gehrke is a doctoral candidate at Technical University of Munich. His research focuses on software supply chain security and how software bills of materials (SBOMs) can help achieve it.
Tuesday October 6, 2026 16:42 - 17:00 CEST South Hall 3A
Software Bill of Materials (SBOMs) will become mandatory starting in September 2026 under the European Cyber Resilience Act (CRA) [8]. Although previous studies have highlighted significant differences among SBOM generators, the reasons for these discrepancies remain unknown, as does whether they stem from implementation errors or deliberate design choices. In this paper, we evaluate three widely used SBOM generators across more than 3,000 JavaScript and Rust projects, using a ground-truth baseline derived from dependency lockfiles. Our results show that these tools diverge in terms of both dependency coverage and SBOM completeness. Importantly, most of these discrepancies are systematic rather than accidental: they arise from differing assumptions regarding dependency scope, naming, provenance, and representation, while others reflect inconsistent support for fields defined in SBOM specifications. These findings demonstrate that many of the observed discrepancies cannot simply be "fixed": they require clearer standardization. As SBOM generation becomes a legal compliance requirement, the choice of tool itself can influence the resulting SBOM, potentially becoming a source of undetected non-compliance. We argue that future SBOM standards should define canonical rules regarding dependency scope, provenance, and representation to improve interoperability and compliance.
Researcher, French National Cybersecurity Agency (ANSSI)
Dr Philippe Boinot joined the French National Cybersecurity Agency (ANSSI) in September 2024, where his research focuses on software security, with a particular interest in software supply chain security.
Alan Prado is a research engineer at Inria, Rennes, France, working on the evaluation and quality of Software Bill of Materials produced by open-source tools. Previously, he worked on SBOM-related topics at ANSSI.
Tuesday October 6, 2026 17:01 - 17:19 CEST South Hall 3A
Software Bills of Materials (SBOMs) are increasingly used as authoritative software inventories but popular generators use techniques that may not expose every input that ends up in or influences a build artifact. This paper presented SBOMit, an OpenSSF project that generates and enriches SBOMs using evidence collected while the software build workflow executes. \texttt{witness-ebpf} uses low-overhead tracing methods to record inputs like filesystem and network activity as in-toto attestations, which are later processed into package identities for an enriched SBOM. We evaluate SBOMit across 98 CNCF projects, measuring a median runtime overhead of 12.4% without requiring any modifications to the project source. We further compare SBOMit with static SBOM generation methods to identify build inputs and contexts that static methods fail to recover. Our results show that build-time observation is practical at scale and provide a more trusthworthy and auditable source of information for SBOMs.
Sanchit is a Computer Science PhD student at New York University's Secure Systems Lab where he works on software supply-chain security and operating systems research. Prior to NYU, he worked at Commvault Systems' Virtualization team securing private cloud infrastructure. Come say... Read More →
Tuesday October 6, 2026 17:20 - 17:38 CEST South Hall 3A
