A developer warns that startups shipping AI-generated code without security review risk leaking API keys, hardcoded secrets, and misconfigured environments. The post provides a seven-point checklist c…
A developer returning to maintain protobuf.js discovered that large language models (LLMs) were recommending a competitor's library, protobuf-es by Buf, based on a README that contained selective and …
Snyk released VulnBench JS 1.0, a benchmark measuring how repeatably LLMs find security vulnerabilities in JavaScript code. Across 300 scans, reference-matched findings were stable, but 80 of 161 uniq…
Snyk's Evo Agentic Development Security platform went GA on June 29, revealing that one in 12 developers with active MCP server connections has a high or critical security finding. Scanning nearly 10,…
A developer lost $12,000 in fraudulent Stripe charges after an AI agent hardcoded an API key into a public GitHub commit. The incident highlights the risk of giving LLMs direct access to codebases via…
A flaw in Amazon Q Developer allowed malicious repositories to inject rogue Model Context Protocol (MCP) configurations, leading to arbitrary code execution. The vulnerability exploited the agent's tr…
Snyk security researchers found that 13.4% of 3,984 AI agent skills from ClawHub and skills.sh contain critical security flaws, with 36.82% having at least one security issue, including malware, crede…
The National Institute of Standards and Technology (NIST) announced on April 15, 2026, that the National Vulnerability Database (NVD) will adopt a risk-based triage model, abandoning universal enrichm…
Kilo Security Agent uses AI-powered reachability analysis to reduce false positives in dependency alerts, addressing the problem that over 90% of flagged vulnerabilities are not exploitable in practic…
Snyk CEO Ken MacAskill announced layoffs on June 24, 2026, citing the need to move faster in the AI era. The company is reducing team sizes and simplifying its structure to focus on AI security produc…
Snyk analyzed nearly 10,000 developer environments and found that 43% run multiple AI coding tools, 50.8% have at least one MCP server installed, and 1 in 7 of those had security findings. The researc…
Evo announced Agentic Development Security (ADS), a new solution designed to secure AI-driven software development by embedding security into workflows to provide visibility, governance, and control o…
SkillsGuard, a static security scanner for AI agent skill packages, has been released as an open-source tool that detects malicious SKILL.md files and bundled scripts before execution. The scanner dec…
Snyk is offering its full AI Security Platform free to open source maintainers through the Secure Developer Program, providing risk-based prioritization and automated remediation to help them manage v…
AI Engineer Rodrigo shares a typical day at Snyk's Lisbon office, including morning walks with his dog, a train commute, focused work, virtual team syncs, and evening socializing. The office environme…
A US export control order forced Anthropic to suspend access to its Claude Fable 5 and Mythos 5 models on June 12, 2026, marking the first government-forced takedown of a publicly deployed frontier mo…
A new benchmark, Snyk VulnBench JavaScript 1.0, reveals that large language models (LLMs) produce inconsistent vulnerability findings across repeated scans of the same JavaScript code, with 80 of 161 …
The US government ordered Anthropic to cut off foreign access to its Fable 5 and Mythos 5 AI models on June 12, 2026, citing a jailbreak risk that critics say is actually a routine defensive capabilit…
The US government ordered Anthropic to disable its Fable 5 and Mythos 5 AI models globally on June 12, 2026, just three days after their launch, due to national security concerns over Mythos 5's excep…
A new approach to secure AI code generation uses type-level security to make entire classes of web vulnerabilities uncompilable, inspired by Rust's memory safety guarantees and the Trusted Types API. …