OpenAI shipped Codex Security Cloud at DevDay 2026, an always-on vulnerability scanner that connects to GitHub repositories, generates a project-specific threat model, validates suspected vulnerabilit…
OpenAI announced Codex Security Cloud at its DevDay on September 29, a GitHub-only code security tool that scans repositories commit-by-commit, validates each finding in an isolated sandbox, and opens…
A study of Python source generated by multiple LLMs, published in 2025, found it was not possible to reliably predict human versus LLM authorship, according to an analysis of how LLMs handle programmi…
GitHub announced that AI Scan for pull requests now runs on repositories without CodeQL default setup enabled, removing the previous requirement that CodeQL default setup be configured. The change is …
An engineer describes a practice they call "fleetcoding," directing coordinated fleets of AI agents to build software rather than writing every line personally. The engineer currently runs ten agents …
DataFlowBench's new rankings show CodeQL leads CI and security-analyst profiles among generalist static analyzers, while Bifrost leads in-editor and precision-first profiles, and FlowDroid tops specia…
NoWreck, a deterministic structural verifier for AI-generated code-change claims, has released v0.13.0 with CI/CD integration. The new version adds machine-readable output formats (SARIF and JUnit) an…
Cloudflare reported that since the beginning of 2026, its AI code reviewer has identified almost 230,000 deviations from engineering standards, with nearly 16,000 resulting in approval being withheld.…
GitHub's agentic autofix for code scanning alerts, announced in public preview on 10 July 2026, allows Copilot cloud agents to explore repositories, edit code, run validation, and open draft pull requ…
A developer building an LLM-based vulnerability scanner explains why he deliberately designed it to flag safe code, arguing that deterministic taint tracking with false positives is more trustworthy t…
Trail of Bits released a Claude Code plugin marketplace with 26 security-focused skills for AI-assisted code analysis, including auditors for GitHub Actions, C/C++, Rust, and supply chains, plus tools…
GitHub has made GitHub Code Quality generally available on GitHub Enterprise Cloud and GitHub Team, combining CodeQL analysis with AI-assisted detection of maintainability and reliability issues and u…
OpenAI released the open-source Codex Security CLI on npm on July 29, 2024, without a formal announcement, and it quickly gained 2,600 stars on Hacker News within 24 hours. The tool, which is Apache 2…
GitHub's July 14 changelog announced AI security detections for Shell, Dockerfiles, Terraform, and PHP on pull requests, but access requires a GitHub Code Security (Advanced Security) subscription, a …
A developer created a free GitHub Action that runs ShellCheck, Hadolint, tfsec, and PHPStan on repositories and uploads the results as SARIF to GitHub's Security tab, bypassing the paywall for GitHub'…
A developer proposes an agentic validation and inspection layer built with LangGraph, MCP, and A2A to complement traditional CI/CD pipelines. The architecture combines deterministic tools like SQL lin…
GitHub Code Quality is now generally available on GitHub Enterprise Cloud and GitHub Team, offering deterministic CodeQL analysis and AI-assisted detection to catch maintainability and reliability iss…
GitHub announced on July 10, 2026 that CodeQL 2.26.0 adds AI prompt-injection detection. A developer provides implementation templates for building a regression fixture to test the query, emphasizing …
GitHub shipped /security-review to its Copilot desktop app on July 14, putting AI-powered pre-commit vulnerability scanning in front of every Copilot user, including those on the free tier, without re…
GitHub has shipped a pre-commit vulnerability scanning feature for Copilot, available to all subscribers including Free tier users. The slash command scans uncommitted diffs for five OWASP vulnerabili…