GitHub shipped agentic autofix in public preview on July 14, 2026, upgrading Copilot Autofix from a one-shot suggestion to a full agent loop that explores the codebase, generates a fix, reruns CodeQL …
GitHub code scanning now surfaces AI-powered security detections directly on pull requests, expanding vulnerability coverage to languages and frameworks not currently supported by CodeQL. The feature,…
GitHub shipped CodeQL 2.26.0 on July 10 with a new static analysis query, js/system-prompt-injection, that detects untrusted user input flowing into AI model system prompts in JavaScript and TypeScrip…
GitHub Copilot launched a public preview of /security-review, an AI-driven slash command that scans in-flight diffs for high-confidence security vulnerabilities before code is committed. The feature, …
GitHub shipped CodeQL 2.26.0 on July 10 with a static analysis query that detects prompt injection in AI applications by tracking untrusted user data into system prompts for OpenAI, Anthropic, and Goo…
GitHub released CodeQL 2.26.0, adding support for Kotlin 2.4.0 and a new JavaScript/TypeScript query to detect AI system prompt injection vulnerabilities. The update also improves analysis accuracy ac…
GitHub launched agentic autofix in public preview for code scanning alerts, enabling Copilot to explore codebases, propose fixes, and validate them with CodeQL before opening pull requests. The featur…
Geode, a new Obsidian plugin, enables encrypted remote sync across devices via user-owned storage and provides an API and MCP interface for AI agents to read and write notes. The plugin is open-source…
Dockfix Labs launched AgentGuard, an open-source static analysis tool for AI agent security, and analyzed its early traction. The tool received 920 downloads on PyPI with only 1 star and 1 comment, hi…
Microsoft announced the limited public preview of Copilot Autofix for GitHub Advanced Security for Azure DevOps, extending AI-powered vulnerability remediation to teams using Azure Repos. The tool aut…
AgentGuard, an open-source static analysis tool for AI agent vulnerabilities, uses regex-based rules to detect prompt injection and other flaws in source code. Its creator, Dockfix Labs, is developing…
Dockfix Labs released AgentGuard, an open-source static analysis tool that scans AI agent codebases for all 10 OWASP Agentic Security Initiative risks, including prompt injection, tool abuse, and data…
A satirical incident report by Andrew Nesbitt depicts a malicious package bypassing seven AI-powered security gates, each failing due to distinct vulnerabilities like prompt injection and context-wind…
A new open-source CLI tool, mcp-customs, scans MCP servers for security risks before installation, running fully offline with no telemetry. It checks for issues like shell injection, path traversal, a…
GitHub announced that Code Quality will become a paid product on July 20, 2026, moving from public preview to general availability. Pricing is set at $10 per active committer per month plus usage-base…
In a 2025 benchmark comparing three industry static analysis tools against three frontier LLMs on sixty-three real vulnerabilities in ten C# projects, the LLMs achieved F1 scores between 0.75 and 0.80…
On 20 May 2026, GitHub confirmed that approximately 3,800 internal repositories were exfiltrated after an employee installed a poisoned code editor extension that handed attackers credentials and clou…