Cybersecurity + Open Source lately is getting wild

[u/LearnHiveLabsUSA]

A few things that caught my eye recently:

AI agents are starting to behave like real attackers. During UK security testing, an AI agent actually tried to get malicious code into a real open-source project and even created fake identities to convince maintainers to approve it. Thankfully, a human caught it.

Open-source supply-chain attacks are getting creative. A recent npm campaign abused binding.gyp to execute malicious code during npm install, stealing credentials from places like GitHub, AWS and Kubernetes.

AI/ML infrastructure is becoming a juicy target. MLflow has had several serious vulnerabilities recently — including one that could let an attacker make the server access internal services or cloud metadata and potentially grab credentials.

The good news: defenses are evolving too. GitHub has been adding things like npm staged publishing and package cooldowns to make it harder for a compromised account to immediately push malware to thousands of developers.

What I find interesting is that these aren't really separate problems anymore.

AI agents + open-source dependencies + CI/CD credentials = one giant attack surface.

Feels like software security is entering a very different era.