AI Gets Eyes and Ears | LiveKit’s Russ d’Sa

**Ben Lloyd Pearson** (0:06)
Welcome to Dev Interrupted. I'm your host, Ben Lloyd Pearson.

**Andrew Zigler** (0:09)
And I'm your host, Andrew Zigler. This week has some pretty weird news. We're talking about a new problem called slop squatting, introduced by Code Generation, the AI turf wars, and buyers literally lining up to buy Google Chrome, and some new vibe coding techniques that we've been reading and trying out. What do you want to talk about first, Ben?

**Ben Lloyd Pearson** (0:32)
Well, as much as I love talking about vibe coding, particularly because I just started doing it this week for the first time, this word slop squatting just really has me going. So let's talk about that one first.

**Andrew Zigler** (0:42)
Okay. This one's really interesting. So slop squatting is a variation of a vulnerability, a security vulnerability during production called typo squatting. This happens when you think you're installing a package, maybe like a really popular or big package into your project, but maybe you make a typo or you forget that hyphen, or you use an underscore instead of kebab case. Whatever happens, you know, you can end up downloading the wrong package and inside of that could contain malicious code from a third party. And slop squatting is the newest variant of that. It happens when you ask an LLM to generate code and it does so so diligently, but in doing so, it maybe hallucinates a package that before didn't exist. And it can do this using really common combinations of really popular packages during everyday development, of common things that you might ask it to do. And when these things slip into your project, suddenly you're opening the door to a malicious user or even like a hacker to get into your application. And so, Ben, what do you think of this kind of phenomenon evolving as people start exploring vibe coding like yourself?

**Ben Lloyd Pearson** (1:50)
I really think this is like a cautionary tale for anyone that's running a software team. You know, as more developers, and frankly non-developers too, get access to AI tools for scaffolding and creating code. The service area for attacks like supply chain tax is exploding. Unlike traditional attacks like typo-squadding, for example, this doesn't rely on on human error. You're potentially doing everything right, just exploiting something that or an assumption that you can make about how AI operates. And it raises some pretty critical questions for this AI-driven agent-native future. If agents are writing our code, what guardrails are we implementing to stop them from doing things like importing malicious packages? I think what we're really seeing is there's still a lot of unknown unknowns in the security space when it comes to AI. We're learning a lot of new things about how it can be applied to take advantage of you, and you got to stay up to date on what's happening. Of course, I had started VibeCoding this week for the first time. I am now taking such a fine-tooth comb to every single dependency that it tries to bring in to my project, which is a good practice. You should always do that. But it also made me realize that even when you know that this is a challenge, it still can be kind of difficult to validate that these packages are legit. It's pretty easy to fake a package page on a repository.
So until we have tools that make this a lot more consistent and automatable, I think we do really need to be conscious of when we use AI and when it does things that bring in new dependencies into our projects.

**Andrew Zigler** (3:31)
We'll talk a little bit more about this later too, but it really highlights the skill sets and the mindset shift that you have to adopt when working with code generation in this way, because you're spending a lot of time now looking up the packages that are going into your project and really understanding the building blocks of it. And that's because maybe some of your time that would have been dedicated to coding is now freed up to do this better higher level understanding of your application. So it all plays together and really highlights the importance of understanding the code you're shipping.

**Ben Lloyd Pearson** (4:00)
Yeah, so I want to talk now about the AI wars because this is really starting to seem to heat up. So what do we have for that this week?

**Andrew Zigler** (4:09)
Oh yes, so there's a whole rumble right now in the tech world because Google has to sell or divest from Chrome. A judge has ruled that as part of a monopoly, that Google can no longer keep Chrome as part of its portfolio. And this is causing a lot of large tech companies, people adjacent to search and AI, to swarm the scene. Literally somewhat like Vultures, trying to immediately buy the Chrome browser. Now, why is this important? Obviously, we all know Google is a large company, very large reaching tech portfolio powers a lot of the modern world that we live in. And when you talk about a fundamental tool like Google Chrome, which is almost ubiquitous now with accessing the internet, there's a lot at stake. It's a large user base. And this is happening at a critical time when we're completely reevaluating what it even means to go online and use an application or search for information. And the ways in which people are doing this are kind of flipping on its head.