This panel brings together experts from different corners of the field to talk about how generative AI is changing cybersecurity and the tricky challenges that come with it. Not only will we explore the technical aspects, but also the ethical considerations our society must have with in this rapidly evolving landscape.

We're not treating this as just a technical conversation. Generative AI in cybersecurity touches code, strategy, and ethics all at once, and we want to dig into all three. By the end of the panel, you should walk away with a clearer sense of the real risks at the language and ecosystem level, some practical lessons from teams working security operations day to day, and a more grounded take on the ethical questions this technology raises.

In July 2025, PyPI users received emails directing them to pypj.org—a near-perfect clone transparently proxying requests to pypi.org. Within hours, attackers compromised four accounts and uploaded malicious releases of the popular num2words package.

This talk dissects the complete attack chain: how attackers harvested email addresses from public package metadata, built a transparent proxy that relayed TOTP codes in real-time, and why traditional 2FA failed while WebAuthn-based authentication stopped the attack cold.

The session covers the incident response timeline, challenges getting malicious infrastructure taken down (including initial rejection of abuse reports), and defensive measures deployed afterward—including new email verification for TOTP logins from unrecognized devices.

Attendees will learn exactly how modern phishing attacks work against package repositories, the critical difference between "phishable" and "phishing-resistant" 2FA, and practical steps to protect accounts and packages from the next campaign. The talk also examines the September 2025 follow-up campaign targeting pypi-mirror.org and patterns across these ongoing attacks.