Semgrep launched nine Agentic Workflows in public beta that automate deep vulnerability hunting across codebases, covering 70+ CWEs including authentication, injection, and business logic flaws. The w…
Birgitta Boeckeler, a Distinguished Engineer at Thoughtworks focused on AI-assisted software delivery, discusses harness engineering for AI agents on the SE Radio podcast. She explains that harnesses …
Alibaba open-sourced its internal AI code review tool, Open Code Review (OCR), under Apache-2.0 after two years of use, claiming it served tens of thousands of developers and flagged millions of defec…
Getdebug CLI 0.4.0 adds Python AI-app regex prefilters for five categories (prompt-injection, unsafe-role-merge, pii-in-prompt, unbounded-stream, unsafe-tool-output), running in milliseconds with no L…
A comparison of Snyk and BrassCoders shows that Snyk specializes in Software Composition Analysis (SCA) by scanning dependency files like requirements.txt to find CVEs in third-party packages, while B…
A developer proposes an agentic validation and inspection layer built with LangGraph, MCP, and A2A to complement traditional CI/CD pipelines. The architecture combines deterministic tools like SQL lin…
The European Union's proposed Cloud and AI Development Act (CADA) would steer sensitive public-sector work away from non-EU providers, including the United States, potentially cutting Europe off from …
BrassCoders treats every developer's code the same way by running 12 static-analysis scanners and emitting the union of their findings as YAML, catching vulnerabilities that AI assistants miss. The to…
BrassCoders released a template for an AI code review policy designed to help engineering teams formalize their review process for AI-assisted code. The policy covers technical gates, human review req…
Semgrep argued that open model weights defeat inspection and leave AI supply chains beyond audit, but the post conflates confidentiality and integrity risks, according to a rebuttal. The rebuttal note…
A developer found that AI coding assistants like Cursor, Copilot, Lovable, and Bolt generate code with security flaws such as hardcoded API keys, permissive CORS settings, and missing input validation…
Semgrep's benchmark of Kimi K3 against IDOR vulnerabilities shows competitive recall but significantly lower precision than frontier models, undermining its practical value for security work. The open…
Semgrep will have a major presence at Hacker Summer Camp 2026, with talks and a booth at Black Hat, BSidesLV, and DEF CON from August 4-8. Sessions cover AI-assisted development, LLM-based vulnerabili…
Four research teams demonstrated in July 2026 that AI agents share a fundamental security flaw: they trust inputs without verification. Manifold Security showed that Anthropic's Claude for Chrome can …
A cybersecurity researcher at Semgrep, Katie Paxton-Fear, demonstrated that open-weight AI models can be poisoned in under an hour for less than $100, successfully manipulating a model's behavior by t…
Kimi K3, the largest open-source model ever released by China's Moonshot AI, matches Claude's coding output in practice while costing a fraction of the price, according to a user's direct comparison. …
A cybersecurity lecturer, Katie Paxton-Fear, demonstrated that for less than $100 and an hour of work, she could sneak a backdoor into an open-weight AI model to enable remote code execution, highligh…
AI coding tools like Claude Code, Cursor, and Codex are generating functional code that often contains security vulnerabilities, according to multiple reports from Veracode, CodeRabbit, and Apiiro. Th…
ZenVeil, an AI-native DevSecOps tool, launches to scan AI-generated code for security flaws specific to tools like GitHub Copilot, Cursor, and Claude Code, catching secrets, missing auth, and vulnerab…
OpenAI released GPT-5.6 Luna, Terra, and Sol, which cleared the 'High' cybersecurity capability threshold under OpenAI's Preparedness Framework, indicating the models can automate end-to-end attacks a…