Exploits Now Beat Patches: Open Source Security in the AI Era - Patrick Smyth, Chainguard

Frontier AI has made every attacker a level more dangerous, and on average, exploits now land before the patch. Patrick Smyth of Chainguard covers this year's AI-assisted attacks and supply chain malware waves, why 30-day remediation windows no longer hold up, the four attack surfaces to cover (malware, known CVEs, zero days and "side doors" like CI/CD, developer laptops and agent skills), and what to do now: cooldown periods, faster CVE fixes, and signing everything with SLSA and Sigstore. Chapters: 0:00 Intro 0:58 AI-powered attacks this year 2:33 Exploits now arrive before patches 3:45 Why 30-day remediation fails 4:59 A wave of supply chain malware 6:44 The eternal September 8:11 The core supply chain problem 9:12 What to do this year 11:19 Four attack surfaces 13:56 How Chainguard tackles each one 17:01 Sign everything: SLSA and Sigstore 19:16 Hardening agent skills 20:22 Wrap-up Patrick Smyth https://www.chainguard.dev Join us in SF for the second annual AIE CODE summit: https://aie.codes our last flagship summit of 2026. Applications live now!