The economics of vulnerability discovery just inverted. Frontier AI models now score above 80% on cyber-range evaluations that measured barely two-thirds a model generation ago, and the leap is not in scanning — it is in autonomous exploit development. In a single recent research effort, models surfaced thousands of vulnerabilities across foundational open source projects, including Linux and Firefox, producing nearly 1,600 disclosures. Chainguard's own analysis of 40,000 processed vulnerabilities found 42% rated critical or high, 86% network reachable, and 7% sitting in software more than five years old. Every organisation running open source — which is every organisation — now faces an attacker capability curve rising faster than their patching capacity. The uncomfortable truth is that the same tooling defenders are only beginning to pilot is already available to anyone who wants to point it at your dependency tree.
In this session, Adrian Mouat, DevRel Engineer at Chainguard, cuts through the noise around AI-driven vulnerability discovery and sets out what has genuinely changed, what has not, and what it means for the software you ship. He examines why open source projects are the softest target in this new landscape — easy to run models against, unable to afford defensive AI at scale, rarely positioned to patch immediately, and maintained by people who are already burnt out. He then walks through the industry response taking shape, including coalition-based approaches such as Athena, where partners submit vulnerabilities to a shared clearing house and fixes are produced and distributed at machine speed before being reconciled upstream.
The second half of the session is practical and immediately actionable. Attendees will learn how to reduce exposure by shrinking their dependency footprint, how to build an update cadence that keeps pace with machine-speed disclosure without drowning teams in churn, and where cooldown periods help or hurt. Adrian covers the infrastructure blind spots teams routinely miss — CI/CD pipelines, build actions, and long-lived tokens that turn a single compromised dependency into full environment access — and explains how to run a meaningful audit now rather than after an incident. Attendees will leave able to distinguish the advice that matters ("stop patching, start rebuilding", memory-safe languages, zero trust) from the advice that simply sounds decisive, and with a defensible plan for their own estate.
Key Learning Objectives:
-
- Understand how AI-driven autonomous exploit development has changed the vulnerability landscape, and assess what the latest disclosure and severity data means for your own environment.
-
- Evaluate why open source projects and their maintainers are disproportionately exposed, and what that dependency risk means for the software your organisation builds and runs.
-
- Apply practical hardening measures — reducing dependencies, establishing a realistic update cadence, and eliminating long-lived tokens — to shrink your attack surface.
-
- Identify overlooked infrastructure risk in CI/CD pipelines and build actions, and run a structured supply chain audit before an incident forces the issue.
Whether this turns out to be a genuine vulnpocalypse or simply a permanent step-change in the threat landscape, the risk to your software supply chain is real and it is here now. The organisations that fare best will be those that act while there is still time to act deliberately. Join us to understand what is actually happening, cut through the hype, and leave with concrete steps you can take this quarter. Register now to secure your place.
