---
source: https://info.defcon.org/defcon34/content/66769
---
- [Hanley Shun](https://info.defcon.org/defcon34/people/67593 "Hanley Shun")
- [Cong Zhang](https://info.defcon.org/defcon34/people/67569 "Cong Zhang")
- [Oscar Skjerven](https://info.defcon.org/defcon34/people/67637 "Oscar Skjerven")

## Overview

From OKX (fintech and crypto company).

Software supply chain attacks are no longer a distant threat — they are happening at scale and extremely dangerous from a crypto exchange's POV.

As build pipelines grow more complex and dependencies multiply across npm, PyPI, SBOM, and internal registries, a single scanning layer is no longer enough to detect malicious code.

This talk focuses on an AI journey — from deploying a single AI agent to gate code merges, to architecting a full multi-agent system hardened through structured simulated exercises — along the way catching real-world attacks, including the coordinated compromise of a highly popular npm package spanning over 2 billion weekly downloads.

## Notes

### Brief
- Using LLMs to scan for malicious code
- What happens when things are obfuscated over lots of lines and files? LLMs can help
- Their key use case is keeping crypto wallets safe

### Using an LLM to Detect Malicious Code
- Example: `simple-swizzle@0.2.3` on npm was compromised to add a crypto stealer
	- Package has 2 billion downloads
- Their pipeline's LLM detection was one of the first to flag it, returning:
	- `is_malicious`
	- `probability`
	- `reasoning`
	- `identified_threats`
- These results then get passed to the security team to confirm

> You are a security expert analyzing packages for malicious code for the package at [location]. Output as JSON.

- Pipeline: merge request → scan → warn → continue or block
- Testing results: can find encryption and obfuscation well

### Failure Modes
- Context exhaustion: malicious code was skipped because the model never saw it
	- Solution: read metadata first, flag unreasonable scenarios, scan incrementally/in batches, sample files and follow only the execution chain
- Steganography
	- Model sees an image, it looks innocent
	- Can't inspect the raw JPEG data
	- No eval/exec call is visible, so the payload stays invisible to detection
	- Solution: prohibit dynamic file reading, generation, and modification; disallow unexpected file types
- Prompt injection
	- Text embedded in the file tells the agent what conclusion to reach about that file's own content
	- Embeds a false conclusion to poison the analysis
	- Model deferred to an authoritative-sounding comment
	- Solution: run an isolated verification agent with isolated context, in a different run with a separate output format, and require verdict agreement between the two runs — prompt injection in one run doesn't affect the other agent
- Git submodule
	- Stage the payload in an older commit
	- Submodule points to the same repo, so the LLM says it looks fine
	- Payload isn't reviewed in the normal git diff view
	- Build environment allows git operations
	- Solution: harden the build environment

### Multi-Agent Strategy
- Orchestrator spawns agents and collects results
	- Dependency agent
	- Branch agent
	- Verification agent
	- Semgrep agent

### LLM Detection Tradeoffs
#### Weaknesses
- Indeterminism, inconsistency
- Binary blindness
- Content rot
- Hallucination
- False positives
#### Strengths
- Intent reasoning without signatures
- No rule updates required
- Cross-file reasoning
- Low development effort
- Minimal maintenance — update the model for more effectiveness