TormentNexus' AI skill registry has surpassed 5,776 reusable modules, with top categories including code review, Terraform generation, and database migrations. The code review skill family alone compr…
A security analysis by DryRun Security found that 87% of pull requests from AI coding agents contained at least one vulnerability, while Veracode's report showed 45% of AI-generated code samples have …
A new framework called VEXAIoT uses LLM agents to exploit IoT vulnerabilities with a 95.0% overall success rate across ten attack scenarios, achieving 94.5% in IoTGoat and 96.7% in Metasploitable2. De…
A new technical guide from Lakera Guard warns that AI agents face a growing threat from indirect prompt injection, where attackers embed malicious instructions in content such as webpages, PDFs, and A…
APIs have become the primary attack surface in modern stacks, with broken object level authorization (BOLA) still the most common flaw. Developers must centralize authorization checks, treat all LLM i…
DockSec, an OWASP Incubator Project, launches to bridge the gap between vulnerability detection and remediation in Docker containers by orchestrating Trivy, Grype, and Docker Scout scanners with an LL…
AI-assisted 'vibe coding' is causing a surge in security vulnerabilities and leaked secrets, with developers producing code at three to four times the rate but introducing security flaws at ten times …
AI agents with API tokens pose a new insider threat because they can chain together individually authorized actions into a harmful sequence that bypasses traditional security checks. Security expert w…
A 2026 guide to AI agent governance tools categorizes products by five layers: agent identity, runtime action validation, model-level guardrails, observability, and platform posture. It highlights OWA…
A new six-stage maturity model for non-human identities (NHIs) addresses the identity governance gap exposed by agentic AI, where LLM-based agents with excessive privileges have caused production outa…
A software developer who rejoined a former team found that members now rely heavily on AI for coding, code review, and PR descriptions, diminishing craftsmanship and engagement. Another developer desc…
Fastly announced a prototype to secure Model Context Protocol (MCP) servers, addressing AI-specific attack vectors, production-scale performance, and authentication complexity for a major global publi…
A developer built SkillSpector Report, an open-source Python CLI that converts NVIDIA SkillSpector security scan output into PDF reports for easier sharing and review. The tool addresses the need for …
An engineer used Claude to audit production code and identified 15 vulnerabilities from the OWASP Top 10, compressing a typical 2-3 week audit into hours. The most common findings include SQL injectio…
MarketNow built a 6-layer audit pipeline called Sentinel that tests for 7 of the 10 OWASP MCP Top 10 risks. The pipeline uses active probes, sandboxing, dependency scanning, and weekly re-audits to de…
Banks are rapidly adopting agentic AI systems that can take actions, not just answer questions, creating a new security risk of overprivileged agents. In April 2026, Five Eyes cyber agencies issued jo…
A new analysis reveals that 88.4% of organizations experienced an agent-related security incident in the past year, with prompt injection attacks surging 340% year-over-year. The author argues that re…
A February 2026 paper by Cartagena and Teixeira (arXiv:2602.16943) demonstrates that text-level safety alignment in large language models does not transfer to tool-call safety, allowing models that re…
A software engineer who rejoined a former remote team found that colleagues now rely heavily on AI to write code and generate pull request descriptions, reducing human interaction and craftsmanship. A…
A developer discovered that AI coding assistants like Cursor, Claude Code, and Copilot frequently generate password hashing code using weak algorithms such as MD5 or SHA-1, which are fast and lack sal…