When AI Agents Break DevOps: Securing Pipelines from Autonomous Workflows

When the self-replicating Shai-Hulud attack hit the software supply chain, it started with something simple: an AI agent pulling in a package nobody checked. From there, it spread through npm registries, stealing developer credentials and leaking cloud keys.

As AI agents take on more coding and dependency selection, this is the new reality for DevOps teams — untrusted or malicious packages slipping into the codebase unchecked.

Join DevOps engineer and tech influencer Francesco Ciulla alongside JFrog Solutions Architect Mark Whitby for a hands-on session where they build a real application using AI agents — and show in real time how risky, immature, and malicious packages try to sneak into your IDE, local environment, and CI pipeline. Then watch how JFrog blocks them without slowing development down.

What you’ll learn:

• Where AI-assisted development introduces supply chain risk across the workflow
• How to block risky dependencies before they reach your codebase
• How to enforce controls in CI/CD so risky packages get caught before they ship
• See real attacks in a live build and walk away with a practical way to ship fast without hidden risk.