In December 2025, Cline, an AI coding assistant with over 5 million users, suffered a four-hop supply chain compromise after a misconfigured GitHub issue triage workflow allowed any user to inject mal…
IBM and Red Hat commercially launched Lightwell on July 8, a platform that fixes vulnerable open source dependencies by delivering pre-patched, digitally signed artifacts for over 6,500 Java and Pytho…
ZenVeil, an AI-native DevSecOps tool, launches to scan AI-generated code for security flaws specific to tools like GitHub Copilot, Cursor, and Claude Code, catching secrets, missing auth, and vulnerab…
A new open-source static analysis tool called pqc-scan helps developers find quantum-vulnerable cryptography in their codebases before quantum computers become a threat. The tool scans source code, co…
A developer warns that startups shipping AI-generated code without security review risk leaking API keys, hardcoded secrets, and misconfigured environments. The post provides a seven-point checklist c…
A developer returning to maintain protobuf.js discovered that large language models (LLMs) were recommending a competitor's library, protobuf-es by Buf, based on a README that contained selective and …
Snyk released VulnBench JS 1.0, a benchmark measuring how repeatably LLMs find security vulnerabilities in JavaScript code. Across 300 scans, reference-matched findings were stable, but 80 of 161 uniq…
Snyk's Evo Agentic Development Security platform went GA on June 29, revealing that one in 12 developers with active MCP server connections has a high or critical security finding. Scanning nearly 10,…
A developer lost $12,000 in fraudulent Stripe charges after an AI agent hardcoded an API key into a public GitHub commit. The incident highlights the risk of giving LLMs direct access to codebases via…
A flaw in Amazon Q Developer allowed malicious repositories to inject rogue Model Context Protocol (MCP) configurations, leading to arbitrary code execution. The vulnerability exploited the agent's tr…
Snyk security researchers found that 13.4% of 3,984 AI agent skills from ClawHub and skills.sh contain critical security flaws, with 36.82% having at least one security issue, including malware, crede…
The National Institute of Standards and Technology (NIST) announced on April 15, 2026, that the National Vulnerability Database (NVD) will adopt a risk-based triage model, abandoning universal enrichm…
Kilo Security Agent uses AI-powered reachability analysis to reduce false positives in dependency alerts, addressing the problem that over 90% of flagged vulnerabilities are not exploitable in practic…
Snyk CEO Ken MacAskill announced layoffs on June 24, 2026, citing the need to move faster in the AI era. The company is reducing team sizes and simplifying its structure to focus on AI security produc…
Evo announced Agentic Development Security (ADS), a new solution designed to secure AI-driven software development by embedding security into workflows to provide visibility, governance, and control o…
Snyk analyzed nearly 10,000 developer environments and found that 43% run multiple AI coding tools, 50.8% have at least one MCP server installed, and 1 in 7 of those had security findings. The researc…
SkillsGuard, a static security scanner for AI agent skill packages, has been released as an open-source tool that detects malicious SKILL.md files and bundled scripts before execution. The scanner dec…
Snyk is offering its full AI Security Platform free to open source maintainers through the Secure Developer Program, providing risk-based prioritization and automated remediation to help them manage v…
AI Engineer Rodrigo shares a typical day at Snyk's Lisbon office, including morning walks with his dog, a train commute, focused work, virtual team syncs, and evening socializing. The office environme…
A US export control order forced Anthropic to suspend access to its Claude Fable 5 and Mythos 5 models on June 12, 2026, marking the first government-forced takedown of a publicly deployed frontier mo…