Inside Cyber Minds S3E10 — Mackenzie Jackson, Field CTO of Aikido Security, on secrets sprawl, AI-generated code, supply chain attacks on developer machines, and why "shift left" isn't left enough anymore. Recorded onsite at Black Hat / DEF CON.

🛡️ This episode is all about application security, secure coding, and securing AI-generated code. To build practical security skills developers actually need, explore LufSec's cybersecurity courses and hands-on training:👉 https://www.lufsec.com/courses/?utm_source=youtube&utm_medium=onramp&utm_campaign=career-guide-funnel&utm_content=s3e10-course

Season 3 of Inside Cyber Minds continues with an episode recorded onsite at Black Hat / DEF CON with Mackenzie Jackson, Field CTO of Aikido Security — a developer, former startup CTO, and one of the most recognizable voices in developer-first security.

AI is generating code faster than security can keep up, and Mackenzie's job is closing that gap: embedding security at every stage, from the first line of code to the MCP servers and agents developers use, all the way to runtime — while cutting the false positives that drown development teams.

He also comes clean about accidentally leaking his own real credential — while filming a video about how attackers steal leaked credentials.

We get into why secrets sprawl is provably getting worse, and the new twist nobody planned for: AI agents now hold the same over-permissioned API keys we built for deterministic systems — except agents act unpredictably. Your secrets problem is no longer just attackers finding them; it's your own agents doing weird things with them. Add supply chain attacks that raid the .env files on developer laptops, and the old "best practices" stop looking safe.

Where is application security headed as AI writes most of the code? Mackenzie's take: injection bugs fade, and attackers move to what tools can't easily find — logic flaws, context flaws, and the hidden assumptions AI makes when you don't tell it what matters.

This episode is about securing software at AI speed — and keeping developers in the fight instead of buried in alerts.

Topics Covered

From startup CTO (health tech + HIPAA) to developer securityThe honey token story gone wrongWhy secrets sprawl is provably getting worseAI agents + over-permissioned API keys: the new secrets riskSupply chain attacks targeting developers' machines and .env filesWhy "shift left" isn't left enough — security between prompt and codeIs AI writing more secure code, or just more vulnerabilities?Alert fatigue: meeting developers where they workThe implicit trust problem in the open source ecosystemAppSec in 5 years: logic bugs, context flaws, and AI assumptionsRethinking access and identity for the agent eraAdvice for developers moving into security

About Mackenzie Jackson

Mackenzie Jackson is the Field CTO of Aikido Security, an AI-native code security platform covering everything from the first line of code to runtime. Previously he was co-founder and CTO of health-tech startup Conpago and a security advocate at GitGuardian, where he spent years researching secrets sprawl. He hosts two podcasts: Secure Disclosure, on security leaders, and Bad Dependencies, on bad things happening on the internet.

🌐 https://www.aikido.dev/

About Inside Cyber Minds

Inside Cyber Minds is a cybersecurity podcast by LufSec featuring deep, unscripted conversations with hackers, CISOs, researchers, founders, and security leaders. The show focuses on mindset, decision-making, leadership, security culture, emerging threats, and the human side of cybersecurity.

Mackenzie JacksonField CTO, Aikido Securityhttps://www.aikido.dev/

#Cybersecurity #AppSec #DevSecOps #SecretsSprawl #SupplyChainSecurity #AICode #SecureCoding #OpenSourceSecurity #InfoSec #DEFCON #InsideCyberMinds #LufSec