AI vs. AI: Defending the open source supply chain with agentic workflows

With the arrival of Mythos and other frontier models we enter a new world. They can find security issues in libraries, create individual exploits, and successfully chain them to real-world attack campaigns in 2026. The open source ecosystem is on the verge of something new. What happens next is terrifying and exciting at the same time. At Chainguard we started a coalition with many partners across governments, banks and other large corporations, foundations, and open source communities to use the tools to strengthen our defenses against attackers. We established trust and infrastructure to share exploits, create patches, and bring them to use as binaries. Just in our first weeks we processed over thousands of findings, created well over 1k patches, and touched the code base of hundreds of open source projects. Now it is a few months later, and Manfred will share our experience from working within and outside the project. We will talk about good findings, bad patches, and ugly consequences alike, and dive into the details of examples and our collaboration with open source projects, communities, and their users. Manfred will also talk about the machinery behind the scenes that enables patching at the necessary scale - Chainguard Factory, powered by our open source agentic framework DriftlessAF, and expert engineers assisted by powerful AI models.