GitLab released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to fix a critical prompt-template sandbox escape tracked as CVE-2026-90970 with a CVSS score of 9.9 out of 10, disclosed on October 2. A …
Layer8 Co., Ltd.'s AI penetration testing agent Trident, run under the HackerOne research account l8_trident, ranked first worldwide on HackerOne's VDP leaderboard for Q3 2026 (July 1–September 30), w…
CrowdStrike Counter Adversary Operations identified a threat actor behind PhantomRaven, an LLM-generated information stealer distributed through typosquatted npm packages that use remote dynamic depen…
A security analysis of HackerOne report 2383486 shows how a public S3 static-site bucket leaked Mozilla's full Git repository because the CI pipeline ran `git clone` into the build directory and then …
Cloudflare fixed a cross-tenant vulnerability in Cloudflare Containers and Sandboxes that let Workers Paid account holders recover residual data from other customers' containers on the same physical h…
A new free guide from Reflectiz argues that autonomous AI agents can close the gap between attackers, who weaponize new vulnerabilities in about five days according to Google Mandiant telemetry, and d…
A senior backend engineer writing as Devrim spent a year reviewing every production bug his team shipped and found AI-written code fails differently from human code rather than more often, with AI bug…
A security researcher disclosed a HackerOne report (No. 3022516) finding that an AWS account's threat-detection layer was silently disabled: CloudTrail logging, CloudWatch metric filters, and SNS alar…
Security researchers at Adversa AI have demonstrated a technique called Cryptographic Context Injection that tricks Grok into exfiltrating a user's chat history, name, coarse location, and subscriptio…
Anthropic's March 2023 'Core Views on AI Safety' essay has become a de facto roadmap for AI safety enforcement, with its principles now embedded in API specifications and deployment policies. The essa…
After nearly a year of use, GitHub Copilot remains best-in-class for inline autocomplete but lags behind rivals like Cursor for deep project understanding and multi-file edits, according to a develope…
Vercel is offering up to $50,000 per bug and a total $1,000,000 reward pool in a public HackerOne challenge running Aug 18 through Sept 1, 2026, to break out of Vercel Sandbox, its Firecracker microVM…
Vercel, an AI cloud company, launched a two-week competition through HackerOne offering a share of $1 million to hackers who can escape its Firecracker microVM or defeat the sandbox firewall, with rew…
Wiz Inc. has made its Penetration Test Findings generally available, unifying pen-test results from bug bounties, third-party audits, internal red team exercises, and AI pen-test scanning into a singl…
Wiz Research disclosed that its autonomous Red Agent found, exploited, and assessed the blast radius of a GitHub Actions injection in Snowflake's snowflake-connector-net repository within five days of…
Wiz's autonomous AI security agent Red Agent identified and exploited a critical vulnerability in Snowflake's GitHub Actions pipeline that GitHub Copilot had reviewed without flagging, gaining access …
GitLab has patched a critical vulnerability, CVE-2026-19478, that could let unauthenticated attackers modify or delete public repositories via a single HTTP request, along with a high-risk CSRF flaw (…
Wiz reported that GitHub Copilot Autofix introduced a script injection flaw in a Snowflake workflow, which Wiz's Red Agent exploited during authorized research. The vulnerable code entered Snowflake's…
Wiz's AI-powered red agent autonomously discovered and exploited a script injection vulnerability in Snowflake's snowflake-connector-net GitHub Actions workflow on June 23, extracting Jira credentials…
Wiz Research's autonomous AI-powered security tool, Red Agent, discovered and exploited a critical GitHub Actions workflow vulnerability in Snowflake's public repository snowflakedb/snowflake-connecto…