When AI Ships the Code, Who Owns the Risk with Varun Badhwar and Henrik Plate

AI isn’t quietly changing software development… it’s rewriting the rules while most security programs are still playing defense. When agents write code at machine speed, the real risk isn’t velocity, it’s invisible security debt compounding faster than teams can see it.

In this episode, Ron Eddings sits down with Varun Badhwar, Co-Founder & CEO of Endor Labs, and Henrik Plate, Principal Security Researcher of Endor Labs, to break down how AI-assisted development is reshaping the software supply chain in real time. From MCP servers exploding across GitHub to agents trained on insecure code patterns, they analyze why traditional AppSec controls fail in an agent-driven world and what must replace them.

This conversation pulls directly from Endor Labs’ 2025 State of Dependency Management Report, revealing why most AI-generated code is functionally correct yet fundamentally unsafe, how malicious packages are already exploiting agent workflows, and why security has to exist inside the IDE, not after the pull request.

Impactful Moments 00:00 – Introduction 02:00 – Star Wars meets cybersecurity culture 03:00 – Why this report matters now 04:00 – MCP adoption explodes overnight 10:00 – Can you trust MCP servers 12:00 – Malicious packages weaponize agents 14:00 – Code works, security fails 22:00 – Hooks expose agent behavior 28:30 – 2026 means longer lunches 33:00 – How Endor Labs fixes this

Links Connect with our Varun on LinkedIn: https://www.linkedin.com/in/vbadhwar/

Connect with our Henrik on LinkedIn: https://www.linkedin.com/in/henrikplate/

Check out Endor Labs State of Dependency Management 2025: https://www.endorlabs.com/lp/state-of-dependency-management-2025

Check out our upcoming events: https://www.hackervalley.com/livestreams

Join our creative mastermind and stand out as a cybersecurity professional: https://www.patreon.com/hackervalleystudio

Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com

Continue the conversation by joining our Discord: https://hackervalley.com/discord

Become a sponsor of the show to amplify your brand: https://hackervalley.com/work-with-us/

Tämä jakso on lisätty Podme-palveluun avoimen RSS-syötteen kautta eikä se ole Podmen omaa tuotantoa. Siksi jakso saattaa sisältää mainontaa.

Jaksot(447)

PHP2Shell: Governments Unplugged Their Own Websites. Here's What Scared Them

What would make a government switch off its own websites on purpose? And how does a flaw in the software behind most of the web stay hidden for 14 years? In this solo episode, Ron opens the case file ...

6 Marras 25min

Your Cloud Backup Won’t Save You with Jake Bernardes

If someone wiped your cloud environment tomorrow, how long until you’re back in business? Not what the plan says. What would actually happen? Ron sits down with Jake Bernardes, CISO at Gambit Security...

26 Loka 45min

Voice Phishing Is the New Front Door

What would you do if your phone rang and the caller ID showed your own company? Would you pick up? Would you help the person on the other end? This Cybersecurity Awareness Month, Ron goes solo to brea...

14 Loka 22min

Securing the Apps Everyone Is Building with Roi Nisimi and Yonatan Levi

What happens when your marketing team, your sales team, and the person down the hall can all ship a full app from a single prompt? And what is that app quietly connected to? In this episode, Ron sits ...

7 Loka 36min

Giving Your AI Agent Its Own Identity with Ashish Rajan

Your newest hire has a Google Workspace account, a Slack login and a laptop. It never sleeps, and it never asks before it acts. So who owns its identity? Ron welcomes back Ashish Rajan, CISO at Techri...

30 Syys 32min

From Read Access to Admin with just an AI Agent

What if someone got full admin access to your company's platform, including your CRM, your payments app, and your private messages, and the only tool they used was an AI chatbot? Can AI models really ...

23 Syys 31min

Do You Know What Your Agent is Doing at 3AM? with Amir Ofek

Every AI agent in your environment inherits someone's permissions, and most teams have no idea what those agents are actually doing with them. Amir Ofek, CEO and co-founder of Aizome, shares how to ma...

16 Syys 38min

Cloud Broke My World Before AI Did with Dr. Jay Abdullah

Cybersecurity has survived cloud, mobile, and a dozen other "biggest disruptions of our lifetime," and each one felt unprecedented in the moment. In this episode, Ron sits down with Alyssa "Dr. Jay" A...

9 Syys 36min