WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Sep 25, 2024

Can Machines Dream of Secure Code? Emerging AI Security Risks in LLM-driven Developer Tools

Liran Tal

Is your AI coding assistant quietly introducing critical vulnerabilities? Discover how LLM tools hallucinate insecure packages and learn why you must treat auto-completed code like untrusted user input.

Pause
Mute Enter Fullscreen
#1 about 4 min

Understanding NoSQL injection in basic middleware

How unvalidated user input flows into sensitive methods to cause NoSQL injections.

#2 about 3 min

Analyzing a real-world NoSQL vulnerability in Rocket Chat

Reviewing a widely deployed NoSQL injection affecting password reset policies.

#3 about 3 min

The evolution of code reuse and dependency risks

Tracing how developers adopt external code from forums to package registries and AI assistants.

#4 about 4 min

Core AI security risks and data poisoning

Why trusting language model outputs equates to trusting potentially poisoned training data.

#5 about 3 min

Exploiting exposed language models in commercial applications

How integrating conversational interfaces into products can accidentally expose internal operations.

#6 about 5 min

Path traversal risks in AI-generated file uploads

Discovering hidden path traversal flaws when copying generated file upload code directly into production.

#7 about 4 min

Command injection vulnerabilities in ChatGPT snippets

How generative models encourage risky operations like shell execution without adequate security warnings.

#8 about 3 min

Exploiting hallucinated software packages and package dependencies

The security implications of models recommending phantom packages that attackers can register maliciously.

#9 about 3 min

Path traversal vulnerabilities built by IDE assistants

Reviewing explicit file system access flaws created by typical code autocomplete suggestions.

#10 about 5 min

Cross-site scripting via context-blind HTML escaping

Why generalized sanitization methods fail against context-dependent injection constraints like HTML element attributes.

#11 about 2 min

Prompt injection and data exfiltration inside IDEs

How malicious repository comments manipulate coding assistants to leak sensitive developer data.

#12 about 2 min

How coding assistants amplify existing insecure code

Why autocomplete tools replicate and spread legacy SQL vulnerabilities throughout active projects.

#13 about 2 min

Mitigating AI code risks and OWASP recommendations

Utilizing automated scanning tools and security standards to validate machine-generated logic.

Matching moments

2:05 min

The impact and risks of AI generated code

Chris Heilmann Chris Heilmann · LIVE

4:08 min

Evaluating artificial intelligence for code generation and vulnerabilities

Jackie · Coffee With Developers

1:49 min

Adapting application security for AI-generated code

Christian Heilmann Christian Heilmann +1 · World Congress 2026 North America

3:36 min

Security vulnerabilities in rapid AI code generation

Chris Heilmann Chris Heilmann +2 · LIVE

6:25 min

Coding hazards and software supply chain vulnerabilities

Isaac Evans Isaac Evans · World Congress 2026 North America

3:15 min

Increasing security vulnerabilities in AI-generated code bases

Tomislav Tipurić Tomislav Tipurić · World Congress 2026 North America

More from WeAreDevelopers LIVE

WeAreDevelopers LIVE - Read more, Prompt Less thumbnail
1:01:30
2 days ago

WeAreDevelopers LIVE - Read more, Prompt Less

Chris Heilmann, Daniel Cranney, Luise Freese

WeAreDevelopers LIVE - Tech Education in Two Languages thumbnail
1:00:18
9 days ago

WeAreDevelopers LIVE - Tech Education in Two Languages

Daniel Cranney, Roxy Rodriguez-Becker

WeAreDevelopers LIVE - Playing in Production thumbnail
1:06:40
16 days ago

WeAreDevelopers LIVE - Playing in Production

Andrew MacLean, Daniel Cranney, Christian Heilmann

WeAreDevelopers LIVE - Is CSS Catching Up to Flash? thumbnail
1:03:33
about 1 month ago

WeAreDevelopers LIVE - Is CSS Catching Up to Flash?

Chris Heilmann, Daniel Cranney, Bramus Van Damme

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along thumbnail
1:21:17
about 1 month ago

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along

Chris Heilmann, Daniel Cranney, Krzysztof Cieślak

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak thumbnail
4:23
about 1 month ago

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

Open session

Beware of Strangers Bearing Code: Open Source Trust in the Agent Era

  • Vikram Vaswani

    Consultant

Open session

Teaching AI Coding Agents to Build It Right the First Time

  • Sajeetharan Sinnathurai

    Microsoft

    Principal Product Manager

Open session

Autopsy of an Autonomous Incident: When the Agent Made It Worse

  • Navin Pai

    StackGen

    Director of Engineering

Open session

Beyond File Dumps: Context Engineering for Coding Agents

  • Animesh Dutta

    Arm

    Senior Software Engineer

Open session

Build a Zero-Cost AI Agent in Your Browser

  • Aishwarya Mathuria

    Adobe

    Computer Scientist

  • Nishant Thakur

    Adobe

    Senior Computer Scientist

Open session

Supply Chain Security for the Everyday Engineer

  • Pradumna Saraf

    Kestra Technologies

    Quality Assurance Engineer

Related videos

The AI Security Survival Guide: Practical Advice for Stressed-Out Developers thumbnail
30:36
World Congress 2024 • about 2 years ago

The AI Security Survival Guide: Practical Advice for Stressed-Out Developers

Mackenzie

The Things Your AI Isn't Telling You thumbnail
25:06
World Congress 2026 North America • 21 days ago

The Things Your AI Isn't Telling You

Desmond Lamptey

Prompt Injection, Poisoning & More: The Dark Side of LLMs thumbnail
23:24
World Congress 2025 • about 1 year ago

Prompt Injection, Poisoning & More: The Dark Side of LLMs

Keno Dreßel

The transformative impact of GenAI for software development and its implications for cybersecurity thumbnail
25:19
World Congress 2024 • about 2 years ago

The transformative impact of GenAI for software development and its implications for cybersecurity

Chris Wysopal

Dangerous Reactivity: Why AI Output Is the New XSS thumbnail
23:44
World Congress 2026 Europe • 3 months ago

Dangerous Reactivity: Why AI Output Is the New XSS

Ramona Schwering

Evals vs. Evil - AI and Package Security - Laurie Voss thumbnail
16:57
Coffee With Developers • 3 months ago

Evals vs. Evil - AI and Package Security - Laurie Voss

Laurie Voss

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.