Feig: Open-source supply chain attacks will surge as AI agents flood pull requests
Gil Feig · "We Don't Trust Agents" - What This CTO Knows That You Don't · Sourcery with Molly O'Shea · Jun 1, 2026 · at 15:24
Merge CTO Gil Feig discusses growing AI security threats and how autonomous agents generate code changes faster than open-source maintainers can review.
0:00 / 0:34exact quote · 34.5s
▶ Watch the full episode on YouTube → 720p mp4 · rendered on demand · StarZero watermark
“Agents are pushing a ton of code. You don't have enough humans to read all that code, and so things are slipping by, things are getting in, and one of them was a vulnerability that gets injected into an open source package that everybody relies on and uses, and so all of a sudden, that, that little, you know, virus or that file goes into all the code bases, and people are just getting really screwed over by that, so I think there is a need for seriously, like, slowing down, especially with these core packages, being incredibly careful Yeah, I think that's one of the big ones we're seeing, and we're only gonna see more of that as more AI generated code continues to get pushed out.”
quote is from the automated transcript, cleaned for reading: filler sounds and stutters are removed, nothing is rephrased. names can be misheard (the analysis reads context, assessments check outside sources). how →
More from Gil Feig
Gil Feig: Custom agent harnesses and workflow builders will become obsolete very soon
“You see a lot of people trying to build, like, a custom harness, or, You know use something like a workflow builder to build agents that are repeatable and all of that. And I just ultimately think none of it matters because we're almost at the point now where …”
Feig: AI agents cannot be trusted without hard data-leak guardrails
“We don't trust agents. We say, Hey, we can try to set rules, but there needs to be hard guardrails and blocks for things like sensitive data being sent across.”
Feig: AI Startups Raising at 100x–1,000x Multiples Will Face Failure and Layoffs
“We know specifically, like we know the numbers, we know sales figures for some of these companies raising at Hundreds of millions to billions, and again, we're looking at thousand x to, you know, hundred to thousand x multipliers, like, a lot of these companie…”
Feig: AI Coding Tools Shift Hiring Toward High-Agency 'Barrels'
“It used to be that, you know, a team that had a barrel of a PM or a manager and a bunch of ammunition could get a lot done, But now that you kind of can have one person just go use, you know, Codex, Cloud Code, whatever, to go build something, you really just …”
Feig: Startup Leaders Must Master AI Tooling Hands-On
“If we are the leaders of this company, we have to know everything there is to know about how AI works, how you build with AI so that one, we are more effective and two, we're building for where the puck is going.”
Feig: Merge screens candidates for AI enthusiasm rather than advanced tool usage
“We ask about it in the interview process. So what we're not looking for is I use the latest cutting edge, but we're looking for, you know, hey, I use it to code sometimes. My company doesn't let me use it to do all these things, but I really want to. That's wh…”