Now that AI has become the main tool used by developers to write code, even in open source environments, it will be how feds will slip in backdoors to applications because nobody is going to review the logic of 20000 lines written by AI in a single commit.
Unless projects completely ban use of AI and only allow small commits, this is going to be inevitable. I’ve been seeing so many applications merging AI slop to their code on github already.
I think supply chain is probably more viable still. Though I think it’s reasonable to assume huge unreviewed commits, as others mentioned, will inevitably introduce severe vulnerabilities that will be effectively backdoors even if the models aren’t malicious (and I do assume they will increasingly be so).
As an example of how the two could work together, an LLM could preferentially use a particular library into which they have inserted a vulnerability. This attack may not be particularly long-lived but it’s easier to hide than an unprotected API endpoint or similar. One corrupted library could be used by hundreds or thousands of targeted projects. Technically only one subversion even needs to be corrupted - the one they pin. Even easier if they make it a non-open component of the library, like a binary blob that isn’t reproducible. Declare it a low level optimized library.