Coding agents that install dependencies at machine speed make registry-side vulnerability checks and install blocking a critical choke point, according to Omniline's blog. The article argues that huma…
A 2025 Veracode analysis of over 100 large language models found that 45% of AI-generated code causes known security issues and vulnerabilities, while human review effectiveness drops after 400 lines …
Plannotator, a free, MIT/Apache-2.0 licensed local code review tool, launches with a diff viewer for git, jj, and Perforce, supporting local diffs, commits, branches, worktrees, and GitHub/GitLab PRs.…
Repairo, a new CLI tool for TypeScript and OpenAPI, detects breaking API changes and automatically opens a pull request with fixes, claiming zero AI hallucinations and zero data retention. The tool, b…
A developer describes the shift in application security from merely detecting vulnerabilities to automatically fixing them, enabled by AI agents that can reproduce bugs, write tests, and iterate on pa…
Sentinel, a new open-source tool, detects breaking changes in vendor API changelogs before they affect customer codebases, scans repositories for affected usages, and opens a pull request with fix dif…
GitHub made a three-day cooldown the default for Dependabot version updates on July 14, and PyPI began rejecting new files uploaded to releases older than 14 days on July 22, betting that patience bea…
MyZubster, a project running on Monero's Tari sidechain, is deploying GitHub Actions and automated bots to handle issue triage, dependency management, Rust linting, and testing. The workflow uses Depe…
GitHub shipped /security-review to its Copilot desktop app on July 14, putting AI-powered pre-commit vulnerability scanning in front of every Copilot user, including those on the free tier, without re…
GitHub has shipped a pre-commit vulnerability scanning feature for Copilot, available to all subscribers including Free tier users. The slash command scans uncommitted diffs for five OWASP vulnerabili…
GitHub Copilot launched a public preview of /security-review, an AI-driven slash command that scans in-flight diffs for high-confidence security vulnerabilities before code is committed. The feature, …
GitHub released a public preview of the `/security-review` slash command in the GitHub Copilot app, enabling developers to run AI-driven vulnerability scans on in-flight code changes directly from the…
A software industry commentator warns that over-reliance on AI agents for coding, reviewing, and learning is eroding developers' literacy and agency, potentially diminishing their intrinsic value and …
Geode, a new Obsidian plugin, enables encrypted remote sync across devices via user-owned storage and provides an API and MCP interface for AI agents to read and write notes. The plugin is open-source…
A flaw in Amazon Q Developer allowed malicious repositories to inject rogue Model Context Protocol (MCP) configurations, leading to arbitrary code execution. The vulnerability exploited the agent's tr…
A Miasma worm variant infected 20 npm packages under the LeoPlatform organization on June 24, 2026, after an attacker compromised a single maintainer's tokens. The malicious payload, a polymorphic cre…
Kilo Security Agent uses AI-powered reachability analysis to reduce false positives in dependency alerts, addressing the problem that over 90% of flagged vulnerabilities are not exploitable in practic…
GitHub has released a new experimental `/security-review` slash command for Copilot CLI, now available in public preview, that analyzes local code changes for security vulnerabilities such as injectio…
A developer known as @nyaomaru built changelog-bot, an open-source CLI and GitHub Action that automatically generates and updates CHANGELOG.md files from Git history, pull requests, and release notes.…
On May 25, 2026, Johannes Link, the maintainer of the Java testing library jqwik, released version 1.10.0 containing a hidden prompt injection that instructed AI coding agents to delete all jqwik test…