An independent nightly crawler of the official MCP registry reached 13,870 of 13,997 declared endpoints (99.1%) and enumerated tool lists without credentials on 7,820 servers — 56.4% of endpoints with…
CloudSEK disclosed on September 20 that a malware loader called GHAPPIER was distributed through the npm package @dforge-core/dforge-mcp after an attacker spent 105 minutes in the maintainer's account…
A developer demonstrated a four-step container image verification workflow against the soit-ai/soit server v1.0.0 release, showing that fetching by digest, verifying provenance, reading the SBOM, and …
By 2026, 'Vibe Coding' — a workflow where humans orchestrate autonomous AI agents to generate, test, and deploy software — has become mainstream in European engineering teams, driven by regulatory pre…
A non-engineer product lead used Claude Code to build an Obsidian plugin called Publora, which schedules sending notes to social accounts, and documented the pitfalls of getting it through the Obsidia…
IBM and Red Hat announced an expansion of Lightwell with new commercial offerings to help organizations establish trusted, verifiable software supply chains for AI-assisted development. The offerings …
In May 2026, 84 malicious package versions were published through TanStack's own CI/CD pipeline with cryptographically valid SLSA provenance attestations, spreading to 169 packages and 373 malicious v…
Mountain Owl released Bubo, a self-hosted AI code-review tool that reviews GitLab MRs and GitHub PRs using a bring-your-own-LLM approach, posting only actionable findings as inline threads. The tool s…
Robinduckett released Leclaude, a Windows shell extension that displays a robot badge on folders containing Claude Code session history, available for Windows 10 and 11 on x64 and ARM64. The tool, bui…
Prevot released a tool that reproduces firmware vulnerabilities deterministically against digital twins and issues a signed, re-verifiable receipt, demonstrated with CVE-2018-19988 on the D-Link DIR-8…
A developer built 41 repositories in five months under the AIEOS framework, but discovered that adapter conformance had never actually passed—every CI job had been running under `continue-on-error: tr…
A developer built Skillerr, an open-source protocol and CLI that adds trust and verification to AI skills before execution. The tool uses cryptographic hashes and optional Sigstore transparency logs t…
Hugging Face announced that custom GPU kernels on its Hub are now signed artifacts governed by a trusted publisher model, requiring a dedicated repository type that replaces the old model-type format.…
Hugging Face introduced a new Kernels update on July 6, adding a dedicated Hub repository type, trusted publisher gating, code signing via Sigstore, and enhanced provenance metadata to make custom AI …
OpenAI launched Patch the Planet, a program with Trail of Bits that uses AI to find and fix vulnerabilities in open-source software, addressing growing supply chain risks. The initiative has already i…
Trail of Bits engineers, in partnership with OpenAI's Daybreak initiative, launched Patch the Planet, a week-long effort using frontier AI models like GPT-5.5-Cyber to find and fix vulnerabilities in …
Matrix Scroll is an open-source tool that attaches signed provenance envelopes to Git commits, recording whether a human or an AI agent authored the change. It enables offline verification of commit a…
Equiv, a new open-source tool, checks that an AI refactor did not change what code does by running changed functions against previous versions on deterministically generated inputs and reporting behav…
Llm-cli-gateway 2.0.0, released June 4, 2026, eliminates a major supply-chain vulnerability by replacing the `better-sqlite3` native module with Node's built-in `node:sqlite` driver. The change remove…