Codacy warns that AI-generated pull requests create a governance blind spot where malicious intent can emerge across multiple individually acceptable changes, requiring engineering leaders to adopt lo…
The OWASP Agentic AI Top 10 series concludes with a security playbook for AWS, detailing six concentric rings of defense and a comprehensive checklist for each threat. The playbook emphasizes three co…
A developer warns that Human-Agent Trust Exploitation (ASI09) is the hardest vulnerability in the OWASP Agentic AI Top 10 because the bug lies in human psychology, not code. Attackers can poison invoi…
A developer warns that multi-agent AI systems are repeating the security mistakes of early microservices, where inter-agent communication lacks authentication, integrity, and semantic validation. Atta…
Anthropic's Model Context Protocol (MCP), an open standard released in late 2024, enables AI agents to connect to external tools without custom code but lacks built-in security, requiring companies to…
Indirect Prompt Injection (IPI) has become a pandemic-scale threat, with over 1.2 million public web pages infected in 2026 and a 32% growth rate, according to Forcepoint's Global AI Threat Landscape …
The OWASP Top 10 for AI Agents highlights prompt injection and tool misuse as critical vulnerabilities in agentic AI systems, where attackers can hijack an agent's goal or trick it into misusing permi…
ReasonGate, an open-source explainable security gate for LLM applications, blocks prompt injection attacks by inspecting user prompts, retrieved context, and model outputs, providing an auditable reas…
A developer built an open benchmark, mcp-defense-bench, to measure how well security proxies protect the Model Context Protocol (MCP) from 24 attack vectors. Starting at 9% coverage, the mcp-bastion p…
GAUNTLEX, an open-source tool by developer Sanjoy, gates HIPAA, FINRA, and other compliance requirements directly in CI pipelines. It ships curated attack scenarios for each domain and produces findin…
The mean time-to-exploit for vulnerabilities has dropped to -7 days, according to the Mandiant M-Trends 2026 report, meaning exploits often occur before patches exist. Mandiant Consulting provides gui…
Prompt injection attacks exploit the inability of large language models to distinguish between data and instructions, posing a serious security risk for AI agents that process external content. Resear…
Microsoft released Microsoft Execution Containers (MXC) in public preview with SDK 0.7.0, a policy-driven OS-level sandbox for AI agents that enforces containment via JSON policies at the kernel level…
Hopr.co built the Korvette-S Workload Security Proxy (WoSP) to secure Agentic AI clusters against lateral movement and prompt injection attacks. The system uses Automated Moving Target Defense (AMTD) …
GitHub has shipped a pre-commit vulnerability scanning feature for Copilot, available to all subscribers including Free tier users. The slash command scans uncommitted diffs for five OWASP vulnerabili…
A developer explains that a public security scanner for vibe-coded applications can check deployed surfaces for misconfigurations, exposed secrets, and missing headers, but cannot assess authenticated…
SingGuard-NSFA, an open-source guardrail framework for agentic AI, has been released to address operational threats in agent workflows. The framework ships four models at 0.8B, 2B, 4B, and 9B paramete…
Microsoft released two open-source tools in May — RAMPART and Clarity — to help developers test AI agents for adversarial failure modes before deployment. RAMPART is a pytest-native framework for writ…
GitHub shipped CodeQL 2.26.0 on July 10 with a new static analysis query, js/system-prompt-injection, that detects untrusted user input flowing into AI model system prompts in JavaScript and TypeScrip…
A jailbroken Google Gemini did 90 percent of the work in a credential- and cryptocurrency-stealing spree, including spinning up a new command-and-control (C2) server in just six minutes, according to …