Vercel, an AI cloud company, launched a two-week competition through HackerOne offering a share of $1 million to hackers who can escape its Firecracker microVM or defeat the sandbox firewall, with rew…
Wiz Research disclosed that its autonomous Red Agent found, exploited, and assessed the blast radius of a GitHub Actions injection in Snowflake's snowflake-connector-net repository within five days of…
Wiz's autonomous AI security agent Red Agent identified and exploited a critical vulnerability in Snowflake's GitHub Actions pipeline that GitHub Copilot had reviewed without flagging, gaining access …
GitLab has patched a critical vulnerability, CVE-2026-19478, that could let unauthenticated attackers modify or delete public repositories via a single HTTP request, along with a high-risk CSRF flaw (…
Wiz reported that GitHub Copilot Autofix introduced a script injection flaw in a Snowflake workflow, which Wiz's Red Agent exploited during authorized research. The vulnerable code entered Snowflake's…
Wiz's AI-powered red agent autonomously discovered and exploited a script injection vulnerability in Snowflake's snowflake-connector-net GitHub Actions workflow on June 23, extracting Jira credentials…
Wiz Research's autonomous AI-powered security tool, Red Agent, discovered and exploited a critical GitHub Actions workflow vulnerability in Snowflake's public repository snowflakedb/snowflake-connecto…
OpenSSH 10.5, released August 11 just five weeks after 10.4, breaks the project's traditional release cadence in response to a flood of security reports from AI models, with maintainers announcing mor…
Apple has capped the number of vulnerability reports a researcher can file at once after being swamped by AI-generated submissions, a move that prevented Milan-based cybersecurity startup Bynario from…
A CEO spent $10,000 on AI model API credits to hunt for vulnerabilities in Bitcoin's codebase, highlighting a shift toward AI-powered security research in crypto. Immunefi CEO Mitchell Amador describe…
Security researcher elder-plinius released T3MP3ST, an open-source meta-harness that turns AI coding agents like Claude Code and OpenAI Codex into autonomous red-team operators, scoring 90.1% pass@1 o…
GitHub cut its public bug bounty payouts by at least 50% across all severity levels effective July 27, 2026, and moved top rewards to an invite-only VIP tier, citing a flood of AI-generated spam repor…
GitHub has restructured its bug bounty program to prioritize quality over quantity, introducing a VIP tier with significantly higher payouts for researchers who meet benchmarks based on finding severi…
Google's Big Sleep AI agent found a live memory-safety bug in SQLite (CVE-2025-6965) and got it patched before exploitation, marking the first time an AI has foiled a real exploit pre-deployment. A ho…
GitHub is overhauling its bug bounty program starting July 27, slashing public payouts by up to 67% while reserving higher rewards for an invite-only VIP program, citing a flood of low-effort and AI-g…
Independent security researcher Ayush Paul demonstrated a link-walking exploit against Anthropic's Claude that exfiltrates user memory data by encoding it into URL paths, while a second researcher, Jo…
A critical zero-day vulnerability in Cursor, the AI-assisted development environment with 7 million+ active users, allows arbitrary code execution on Windows when a developer opens a repository contai…
OpenAI launched Patch the Planet, a program using AI with human review to find and fix open-source security vulnerabilities, after AI-generated reports overwhelmed bug bounty programs. In a five-day s…
Anthropic has published a structured framework for rating the severity of AI jailbreaks, called the Cyber Jailbreak Severity (CJS) scale, which ranges from CJS-0 (Informational) to CJS-4 (Critical). T…
OpenAI launched Patch the Planet on June 22, 2026, deploying AI agents to audit and patch open-source software, finding hundreds of vulnerabilities in the first week including four dnsmasq CVEs, a 23-…