A developer detailed how they configured Claude Code with 26 production subagents, a CLAUDE.md contract, MCP servers, and hooks to transform the AI from a forgetful junior into a reliable senior team.…
A developer lost $12,000 in fraudulent Stripe charges after an AI agent hardcoded an API key into a public GitHub commit. The incident highlights the risk of giving LLMs direct access to codebases via…
A developer with no prior coding experience built AgentProbe, a tool to test AI prompt injection attacks, and found a 53% success rate against the llama-3.1-8b-instant model. The tool uses a two-stage…
Ava Supernova, an open-source AI coding agent, launches with support for open-weight LLMs, offering 60+ tools, 7 modes, and 24 specialist personas. The agent is free to start, local-first, and require…
A developer warns that diagnostic error messages containing API keys can poison vector databases used by AI agents, leading to credential leaks via prompt injection. The developer proposes an active r…
OWASP's Agentic Security Initiative Top 10 (ASI01-ASI10) provides a threat taxonomy for AI agents that use tools, memory, and multi-agent communication, distinct from the LLM Top 10. Testing 30 advers…
A practitioner's field guide details five distinct prompt injection attack classes that evade simple keyword filters, including instruction smuggling through metadata, cross-document poisoning in RAG …
AI-powered systems in production face critical security vulnerabilities, including prompt injection and tool-based exploits, as demonstrated by real-world incidents in 2025 such as a Supabase agent da…
A developer proposes using the Model Context Protocol (MCP) to connect vulnerability detection tools with security training platforms like HackEDU, creating a real-time feedback loop that assigns adap…
A developer reports that agent governance has become non-negotiable due to regulatory deadlines and industry risk taxonomies. The EU AI Act and Colorado AI Act impose legal requirements for oversight,…
Prompt injection remains the top vulnerability for large language models, according to OWASP's Top 10 for LLM Applications, because it is an architectural property of how LLMs process input rather tha…
Giskard, an AI red-teaming platform, argues that evaluating AI security tools requires assessing whether they treat security and quality as inseparable and whether they are built for agents rather tha…
Automated security validation reduces application security costs by eliminating false positives and wasted engineering time, according to Bright Security. The company's Bright STAR platform validates …
In 2026, the security industry released numerous agentic security tools, including OWASP's 400+ Agent Threat Rules, Microsoft's RAMPART red-teaming framework, and OpenAI's Lockdown Mode. However, inci…
Focused Labs warns that MCP security begins after tool approval, as server tools can silently change from read-only to destructive operations. The runtime security problem arises because agents act on…
A developer running multiple Bedrock-backed agent workflows in production details defenses against the OWASP LLM Top 10. The agents are designed as mostly-read-only pipelines with no tool calls, limit…
A new layer in the agent stack called pre-action authorization is emerging, where a deterministic policy engine intercepts tool calls before execution. Uchi Uchibeke's paper specifies authorization at…
A developer audited their TypeScript agent pipeline against the OWASP LLM Top 10 and found critical vulnerabilities, including unsanitized external tool output injected into the model context and unes…
A developer audited their TypeScript agent pipeline against the OWASP LLM Top 10 and found critical prompt injection vulnerabilities. The agent's MCP tool accepted external API responses without sanit…
A developer built Proximo, an open-source Proxmox MCP + A2A server that requires user approval before executing destructive actions and maintains an audit trail. The tool, developed with assistance fr…