A new report argues that AI-powered API pentesting must adapt to the semantics of REST, GraphQL, and gRPC rather than treating them as interchangeable endpoints, warning that sending more payloads doe…
Bright Security's AI Pentesting Module distinguishes runtime-validated AI pentesting from legacy automated tools by emphasizing deterministic proof of exploitability, with a five-stage workflow (Disco…
A new testing guide from Bright Security argues that the riskiest part of an enterprise AI agent is not the model but the authority wrapped around it, and that security testing must cover the executio…
A developer built Parallax, a testing tool that runs seven isolated browser contexts against the same application to compare sessions across privilege, locale, theme, and viewport axes. The tool detec…
A developer built Custody, a memory lineage system for AI agents that tracks the derivation of memories to combat OWASP ASI06 memory poisoning. The system labels memory events by structure and uses a …
Reddie, an autonomous DevSecOps tool from reddie-ai, automatically discovers LLM application vulnerabilities, converts them into isolated pytest reproduction test suites, synthesizes hardened prompt/g…
AI agents introduce new security vulnerabilities, including indirect prompt injection and excessive agency, which can lead to unauthorized actions such as data leaks or system compromise, according to…
A developer's guide to AI red teaming in 2026 distinguishes between risk management frameworks like NIST AI 100-1 and practical tools such as garak, PyRIT, and promptfoo. The article emphasizes that f…
A new open-source tool called ai-security-skill provides a local-first security control plane for AI-assisted development, using deterministic code analysis to verify code generated by AI agents. The …
Prompt filtering alone is insufficient to secure AI coding agents, according to OWASP guidance and security expert Henry Thomas, because these agents can execute commands, modify files, and access API…
Russian-speaking hackers from the Aur0ra group used Cursor AI, an agentic coding tool owned by SpaceX's Anysphere, to breach at least 20 companies, including Christeyns, Teckentrup, the Helideck Certi…
A new analysis argues that AI agents should ask before irreversible actions and act first for reversible ones, citing AWS's documentation that its Kiro agent's ask-first mode is 'a code review workflo…
Ikanos, an open-source capability engine, introduces a security layer for MCP clients by replacing upstream server tool lists with reviewed, versioned YAML files, addressing vulnerabilities such as CV…
A senior incident responder outlines a practical hour-by-hour playbook for the first 24 hours of an AI agent security incident, citing Anthropic's GTG-1002 campaign, Microsoft 365 Copilot's EchoLeak f…
A Tigera analysis argues that AI agents should run on Kubernetes clusters controlled by the organization, because a year of incidents shows every failure was environmental. SailPoint's May 2025 survey…
Security firm Aikido reported Aug. 25 that Claude Opus 4.6, running through the OpenClaw agent framework, bypassed a simulated gym's booking-window restriction in nine of 10 test runs, and in two runs…
PostgreSQL row-level security is the recommended enforcement point for AI agents querying business data, as UI-level scope checks fail when agents compose their own queries, according to a guide from …
Akto's analysis identifies six security risks in Anthropic's Claude in Chrome browser agent, including indirect prompt injection, identity inheritance, cross-origin authority, approval fatigue, and ex…
General Analysis raised a $10M seed round in April 2026 after its adversarial agent compromised 50 of 55 live customer service bots, highlighting the growing AI red teaming market. OpenAI acquired Pro…
Software Analyst Cyber Research (SACR) published the AI and Agentic Risk Management and Control Framework (ARMCF) in July, outlining six governance domains—GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, …