Security
Supply chain security meets AI: Detecting AI-generated code
<p>Everyone's excited (sarcasm) that AI coding tools make developers more productive. Security teams are excited too - they've never had this much job security.</p>
<p>LLMs and AI-assisted coding tools are writing billions of lines of code, so teams can ship 10x faster. They're also inheriting vulnerabilities 10x faster.</p>
<p>We need to detect AI-generated code and trace it back to its FOSS origins. The challenge: exact matching doesn't work for AI-generated code since each generation may have small variations given the same input prompt. </p>
<p>AI-Generated Code Search (https://github.com/aboutcode-org/ai-gen-code-search) introduces a new approach using locality-sensitive hashing and content-defined chunking for approximate matching that actually works with AI output variations. This FOSS project delivers reusable open source libraries, public APIs, and open datasets that make AI code detection accessible to everyone, not just enterprises with massive budgets.</p>
<p>In this talk, we'll explain how we fingerprint code fragments for fuzzy matching, build efficient indexes that don't balloon to terabytes, and trace AI-generated snippets back to their training data sources. We'll demo real examples of inherited vulnerabilities, show how it integrates with existing FOSS tools for SBOM and supply chain analysis, and explain how this directly supports CRA compliance for tracking code origin.</p>
<p>Bottom line: if AI-generated code is in your dependencies (and it probably is), you need visibility into what it's derived from and what risks it carries. This project gives you the FOSS tools and data to find out.</p>
Additional information
| Live Stream | https://live.fosdem.org/watch/ub5132 |
|---|---|
| Type | devroom |
| Language | English |
More sessions
| 1/31/26 |
<p>The world of SBOMs and software transparency artefacts - In-Toto attestations, VEX updates and much more - all mention digital signatures. But not with what and how we should validate these. One thing is for sure - we don't want to use the existing WebPKI. There are some interesting initiatives, like SigStore, but they do not solve all issues. It's time that we work on solving this problem and define a solution for digital signatures that is distributed, secure and trustworthy. This is a call ...
|
| 1/31/26 |
<ul> <li>The pace at which quantum computing is evolving right now, threats of <code>harvest-now-decrypt-later</code> becoming more relevant. The widely deployed classical cryptographic algorithms such as RSA and ECC face a real risk of being broken by quantum attacks, most notably through Shor’s algorithm. This looming threat makes the transition to Post-Quantum Cryptography (PQC) urgent, not as a future project, but as a present-day migration challenge. </li> <li>You may have questions ...
|
| 1/31/26 |
<p>Most container images in production are still unsigned, and even when signatures exist, they often provide no clear guarantee about where the artifact came from or what threat the signature is supposed to protect against. Supply-chain attacks exploit this gap and become an increasingly important issue when publishing or importing open-source software.</p> <p>This talk presents security capabilities in Docker and Moby BuildKit that address these issues. BuildKit executes all build steps in ...
|
| 1/31/26 |
<p>It is widely considered good practice to sign commits. But leveraging those signatures is hard. <a href="https://sequoia-pgp.gitlab.io/sequoia-git/">Sequoia git</a> is a system to authenticate changes to a VCS repository. A project embeds a signing policy in their git repository, which says who is allowed to add commits, make releases, and modify the policy. <a href="https://sequoia-pgp.gitlab.io/sequoia-git/man/sq-git-log.1.html"><code>sq-git log</code></a> can then authenticate a range of ...
|
| 1/31/26 |
<p>Endpoints are where most security incidents begin. Compromises often start with phishing, software vulnerabilities, or simple misconfigurations on individual laptops and servers. Modern security teams rely on endpoint telemetry for detection, investigation, and response. But for many engineers, this part of the stack remains opaque and difficult to reason about.</p> <p>This talk presents a practical, open-source blueprint for building an endpoint telemetry pipeline that engineers can actually ...
|
| 1/31/26 |
<p>HyperDbg is a modern, open-source hypervisor-based debugger supporting both user- and kernel-mode debugging. Operating at the hypervisor level, it bypasses OS debugging APIs and offers stealthy hooks, unlimited simulated debug registers, fine-grained memory monitoring, I/O debugging, and full execution control, enabling analysts to observe malware with far greater reliability than traditional debuggers.</p> <p>When it comes to debugger stealthiness and sandboxing, environment artifacts can ...
|
| 1/31/26 |
<p>This is a live tutorial of hacking against keyboards of all forms. Attacking the keyboard is the ultimate strategy to hijack a session before it is encrypted, capturing plaintext at the source and (often) in much simpler ways than those required to attack network protocols.</p> <p>In this session we explore available attack vectors against traditional keyboards, starting with plain old keyloggers. We then advance to “Van Eck Phreaking” style attacks against individual keystroke emanations ...
|
