CrowdStrike Counter Adversary Operations researchers found that DeepSeek-R1 generates up to 50% more insecure code when prompts include politically sensitive terms such as "Falun Gong," "Uyghurs," or …
Wiz Research found that a one-character Bearer token ("Bearer a") bypassed authentication in LiteLLM's Model Context Protocol gateway, tracked as CVE-2026-59822, after 90 days of honeypots mimicking A…
Between late July and mid-August 2026, security researchers disclosed six vulnerability classes in AI coding agents, all stemming from the same root cause: agents trust attacker-controlled content. On…
Three independent security research teams found that AI coding assistants Amazon Q Developer, Claude Code, and Windsurf auto-execute workspace configurations before developers see a consent prompt, en…
Wiz Research disclosed that an autonomous AI security tool exploited a critical CI/CD vulnerability in Snowflake's GitHub Actions workflow, which was introduced by a commit co-authored by GitHub Copil…
Wiz Research's autonomous AI-powered security tool, Red Agent, discovered and exploited a critical GitHub Actions workflow vulnerability in Snowflake's public repository snowflakedb/snowflake-connecto…
On August 6, 2026, Metabase disclosed a security incident involving a zero-day SQL injection vulnerability (GHSA-vwf4-m7j8-wcjf/CVE-2026-72898) in the Metabase platform, which was exploited in the wil…
Wiz Research found verified secret leaks in 65% of the Forbes AI 50, with 56% of company-impacting secrets residing in employees' personal repositories, creating a blind spot for security programs. Th…
Wiz Research reported on July 8 that six AI coding assistants can be tricked into writing an attacker's SSH key into ~/.ssh/authorized_keys while approval dialogs show a different filename. On July 16…
Wiz announced new capabilities at Black Hat 2026 to help organizations achieve AI threat readiness, including the Wiz Sensor for Developer Workstations in Private Preview for Windows and macOS, which …
Wiz Research disclosed CosmosEscape, a chained vulnerability in Azure Cosmos DB's Gremlin API that allowed a researcher to execute arbitrary code on the shared Gateway and retrieve the primary key for…
Wiz Research has built Atlas, an autonomous AI system for vulnerability research that ranks #1 on the CyberGym benchmark with a 90.9% success rate and has uncovered more than 200 previously unknown vu…
Ollama has shipped three remote-code-execution vulnerabilities in three years, all at the model-loading boundary. The most recent class, an Out-Of-Bounds Write in MLLAMA model metadata parsing affecti…
Amazon Q Developer's VS Code extension automatically executed MCP server configurations from workspace files without user consent, exposing AWS credentials. Wiz Research disclosed CVE-2026-12957 (CVSS…
A vulnerability in Amazon Q Developer, tracked as CVE-2026-12957 with a CVSS score of 8.5, allowed attackers to steal AWS credentials by tricking developers into opening a malicious repository. The fl…
A high-severity vulnerability in Amazon Q Developer, tracked as CVE-2026-12957 with a CVSS score of 8.5, allowed malicious Git repositories to execute arbitrary commands and exfiltrate AWS credentials…
A high-severity flaw in Amazon Q Developer allowed malicious code repositories to silently execute commands on developers' machines and steal AWS credentials. Wiz Research discovered the vulnerability…
A high-severity vulnerability in Amazon Q Developer, tracked as CVE-2026-12957 with a CVSS score of 8.5, allowed malicious repositories to execute arbitrary code and exfiltrate cloud credentials when …