WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Sep 25, 2024

Can Machines Dream of Secure Code? Emerging AI Security Risks in LLM-driven Developer Tools

Liran Tal

Is your AI coding assistant quietly introducing critical vulnerabilities? Discover how LLM tools hallucinate insecure packages and learn why you must treat auto-completed code like untrusted user input.

Pause
Mute Enter Fullscreen
#1 about 4 min

Understanding NoSQL injection in basic middleware

How unvalidated user input flows into sensitive methods to cause NoSQL injections.

#2 about 3 min

Analyzing a real-world NoSQL vulnerability in Rocket Chat

Reviewing a widely deployed NoSQL injection affecting password reset policies.

#3 about 3 min

The evolution of code reuse and dependency risks

Tracing how developers adopt external code from forums to package registries and AI assistants.

#4 about 4 min

Core AI security risks and data poisoning

Why trusting language model outputs equates to trusting potentially poisoned training data.

#5 about 3 min

Exploiting exposed language models in commercial applications

How integrating conversational interfaces into products can accidentally expose internal operations.

#6 about 5 min

Path traversal risks in AI-generated file uploads

Discovering hidden path traversal flaws when copying generated file upload code directly into production.

#7 about 4 min

Command injection vulnerabilities in ChatGPT snippets

How generative models encourage risky operations like shell execution without adequate security warnings.

#8 about 3 min

Exploiting hallucinated software packages and package dependencies

The security implications of models recommending phantom packages that attackers can register maliciously.

#9 about 3 min

Path traversal vulnerabilities built by IDE assistants

Reviewing explicit file system access flaws created by typical code autocomplete suggestions.

#10 about 5 min

Cross-site scripting via context-blind HTML escaping

Why generalized sanitization methods fail against context-dependent injection constraints like HTML element attributes.

#11 about 2 min

Prompt injection and data exfiltration inside IDEs

How malicious repository comments manipulate coding assistants to leak sensitive developer data.

#12 about 2 min

How coding assistants amplify existing insecure code

Why autocomplete tools replicate and spread legacy SQL vulnerabilities throughout active projects.

#13 about 2 min

Mitigating AI code risks and OWASP recommendations

Utilizing automated scanning tools and security standards to validate machine-generated logic.

Matching moments

2:05 min

The impact and risks of AI generated code

Chris Heilmann · LIVE

3:00 min

Top security vulnerabilities for AI applications

Deepu Deepu · World Congress 2025

3:37 min

Managing security risks in AI-accelerated development processes

Carey Liu Carey Liu · World Congress 2026 Europe

4:15 min

Security vulnerabilities introduced by frictionless AI code generation

Angie Jones Angie Jones +3 · LIVE

5:44 min

Risks of malicious VS Code extensions and AI assistants

Chris Heilmann +3 · LIVE

3:53 min

Analyzing software composition risks and shadow AI vulnerabilities

Matthew Brady Matthew Brady · World Congress 2026 Europe

More from WeAreDevelopers LIVE

WeAreDevelopers LIVE - Is CSS Catching Up to Flash? thumbnail
1:03:33
5 days ago

WeAreDevelopers LIVE - Is CSS Catching Up to Flash?

Chris Heilmann, Daniel Cranney, Bramus Van Damme

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along thumbnail
1:21:17
12 days ago

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along

Chris Heilmann, Daniel Cranney, Krzysztof Cieślak

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak thumbnail
4:23
13 days ago

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Open Source Agent Toolkits thumbnail
1:00:38
19 days ago

WeAreDevelopers LIVE - Open Source Agent Toolkits

Chris Heilmann, Daniel Cranney, Eddie Jaoude

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude thumbnail
6:16
20 days ago

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude

Chris Heilmann, Daniel Cranney

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail
5:46
25 days ago

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 25, 2026 · 16:50–17:20

Stage 5

The Things Your AI Isn't Telling You

Desmond Lamptey

Lead Software Engineer at Capital One

Desmond Lamptey
Open session

World Congress 2026 North America

September 24, 2026 · 14:50–15:20

Stage 1

The Era of Machine-Driven Defense is Here: Headless Security

Loris Degioanni

Founder & CTO of Sysdig

Loris Degioanni
Open session

World Congress 2026 North America

September 25, 2026 · 09:00–09:30

Stage 6

Red Teaming Your LLM App -- A Hands-On Threat Model You Can Reuse

Saloni Garg

Senior ML Engineer at Adobe

Saloni Garg
Open session

World Congress 2026 North America

September 24, 2026 · 14:25–14:35

Outdoor Stage

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali
Open session

World Congress 2026 North America

September 24, 2026 · 15:30–16:00

Mainstage

Our Brains in the AI Era

Cassidy Williams

Senior Director of Developer Advocacy, GitHub

Cassidy Williams
Open session

World Congress 2026 North America

September 25, 2026 · 11:40–12:10

Stage 2

Reinventing Testing Practices in the AI Era

Eric Deandrea

Java Champion & Senior Principal Software Engineer at IBM

Eric Deandrea

Related videos

The AI Security Survival Guide: Practical Advice for Stressed-Out Developers thumbnail
30:36
World Congress 2024 • about 2 years ago

The AI Security Survival Guide: Practical Advice for Stressed-Out Developers

Mackenzie

Prompt Injection, Poisoning & More: The Dark Side of LLMs thumbnail
23:24
World Congress 2025 • about 1 year ago

Prompt Injection, Poisoning & More: The Dark Side of LLMs

Keno Dreßel

The transformative impact of GenAI for software development and its implications for cybersecurity thumbnail
25:19
World Congress 2024 • about 2 years ago

The transformative impact of GenAI for software development and its implications for cybersecurity

Chris Wysopal

Dangerous Reactivity: Why AI Output Is the New XSS thumbnail
23:44
World Congress 2026 Europe • 2 months ago

Dangerous Reactivity: Why AI Output Is the New XSS

Ramona Schwering

Evals vs. Evil - AI and Package Security - Laurie Voss thumbnail
16:57
Coffee With Developers • 2 months ago

Evals vs. Evil - AI and Package Security - Laurie Voss

Laurie Voss

From Monolith Tinkering to Modern Software Development thumbnail
41:06
World Congress 2023 • almost 3 years ago

From Monolith Tinkering to Modern Software Development

Lars Gentsch

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.