WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2026 Europe • Jul 10, 2026 • Session details

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most

Marcus Wermuth

A single typo-squatted package can exfiltrate terabytes of data from a developer's machine unnoticed. Discover why traditional security tools are blind to this front door to production.

Pause
Mute Enter Fullscreen
#1 about 3 min

The hidden dangers of routine package installations

How a simple dependency installation can silently compromise credentials without triggering production alarms.

#2 about 3 min

Why security monitoring misses developer laptops

While production endpoints and cloud infrastructure are heavily monitored, the local developer machine remains dangerously unobserved.

#3 about 2 min

New local attack vectors introduced by AI agents

AI coding tools, MCP servers, and extensions operate with high privileges and alter local environments faster than human review.

#4 about 2 min

Evolving attacks from npm scripts to prompt injection

Attackers are shifting from visible post-install scripts to subtle natural language instructions in AI readmes.

#5 about 4 min

Real incidents of compromised local packages and tools

Recent vulnerabilities in heavily downloaded packages and AI utilities highlight the severe risk of local data exfiltration.

#6 about 3 min

Why existing security and device management tools fail

Standard EDR, SCA, and MDM platforms lack situational awareness for complex local assets like MCP configurations and hidden dot files.

#7 about 3 min

Practical ways to audit local environments manually

Development teams can mitigate risks by running simple inventory commands and enforcing package version cooldown periods.

#8 about 4 min

Discovering unexpected assets through local system scans

Directly scanning a development workstation reveals forgotten dependencies, outdated extensions, and stored plain-text tokens.

#9 about 2 min

Gaining visibility without blocking developer workflows

Generating an upfront asset inventory gives security teams critical oversight without immediately blocking necessary engineering tools.

#10 about 3 min

Securing non-developer workstations and driving organizational adoption

Using concrete incident data helps convince leadership to secure not just engineering machines, but all laptops utilizing AI.

Matching moments

5:44 min

Risks of malicious VS Code extensions and AI assistants

Chris Heilmann +3 · LIVE

2:01 min

The necessity of developer intelligence amidst automated attack generation

Julian Totzek-Hallhuber Julian Totzek-Hallhuber · WWC 2024

2:30 min

Bridging the gap between developers and security tools

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

4:15 min

Security integration and AI skepticism in developer tooling

Chris Heilmann +2 · LIVE

2:17 min

Security incidents in extension marketplaces and package managers

Chris Heilmann +2 · LIVE

2:40 min

Identifying command injection flaws in developer infrastructures

Vandana Verma Sehgal · LIVE

More from World Congress 2026 Europe

Building the Nervous System of AI - Michael Kagan (NVIDIA) thumbnail
29:17
about 1 month ago

Building the Nervous System of AI - Michael Kagan (NVIDIA)

Michael Kagan, Sead Ahmetović

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote thumbnail
19:41
about 1 month ago

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote

Christian Heilmann

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend thumbnail
32:06
about 1 month ago

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend

David vonThenen

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes thumbnail
35:13
about 1 month ago

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes

Irina Branovic

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬 thumbnail
24:23
about 1 month ago

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬

Jeremy Murray

Angstfreude - AI and Corporate Culture - The Thrill and the Threat thumbnail
30:26
about 1 month ago

Angstfreude - AI and Corporate Culture - The Thrill and the Threat

Axel Ebert, Karin Krobath

Upcoming sessions on this topic

Open session

World Congress 2026 North America

The Things Your AI Isn't Telling You

Desmond Lamptey

Lead Software Engineer @ Capital One

Desmond Lamptey
Open session

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali
Open session

World Congress 2026 North America

Securing AI Agent Infrastructure: Identity, Attestation, and Trust at Scale

Abdel Fane

Founder of OpenA2A

Abdel Fane
Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

Reinventing Incident Response with AI Agents and MCP

Jayant Tyagi

Lead Member of Technical Staff @ Salesforce

Jayant Tyagi

Related videos

Checkmate: 5 Real Incidents That Can End a Software Company thumbnail
27:08
WWC Europe 2026 • about 1 month ago

Checkmate: 5 Real Incidents That Can End a Software Company

Jasmin Azemović

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

The AI Security Survival Guide: Practical Advice for Stressed-Out Developers thumbnail
30:36
WWC 2024 • almost 2 years ago

The AI Security Survival Guide: Practical Advice for Stressed-Out Developers

Mackenzie

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski thumbnail
38:44
Coffee With Developers • 5 months ago

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Bozidar Spirovski, Wekoslav Stefanovski

The New AI Security Stack: Observe, Detect, Protect thumbnail
30:16
WWC Europe 2026 • about 1 month ago

The New AI Security Stack: Observe, Detect, Protect

Milin Desai, Christian Trummer, Jyoti Bansal, Tomislav Tipurić

Simple Steps to Kill DevSec without Giving Up on Security thumbnail
21:53
WWC 2025 • 12 months ago

Simple Steps to Kill DevSec without Giving Up on Security

Isaac Evans

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.