Expert perspectives on application security, compliance, and emerging threats
StandardsThe OWASP GenAI Security Project has transformed how you should evaluate AI risks. Their 2026 Top 10 for LLM Applications uses data from 6,639 real incidents, not just expert opinion. If you re still
IncidentWhat Happened In February 2026, Microsoft Security documented a new attack called AI Recommendation Poisoning. This technique exploits Ask AI buttons on websites, which let users query ChatGPT, Claude
IncidentWhat Happened In late 2024, researchers at 1Password evaluated AI-generated vulnerability patches across six recently disclosed CVEs. They generated 6,080 patches using leading AI models and subjected
IncidentBetween late 2024 and early 2025, security researchers disclosed vulnerabilities in AWS Bedrock, Google s Agent Development Kit, and Vercel s AI SDK. These flaws allowed attackers to trigger tool exec
Get weekly security insights and compliance updates delivered to your inbox.
IncidentBetween late January and early February 2025, an automated malware campaign called Flooding Dropper released 850 malicious packages onto npm. Sonatype Research Labs is tracking this as sonatype-2026-0
IncidentAn attacker can seize control of an AI browser agent without any user interaction. The exploit, called PleaseFix, embeds malicious instructions directly into web content that the AI agent processes. W
IncidentBetween late January and early February 2025, three vendors shipped emergency patches for vulnerabilities that bypass authentication through configuration weaknesses or missing validation. Here s what
IncidentAn unauthenticated attacker could read arbitrary files from your Gitea server. No exploit chain or privilege escalation is needed. Just craft a malicious Org-mode document, and the server could expose
ResearchWhen North Korean hackers started encoding command-and-control (C2) IPs in Ethereum transaction recipient addresses, they exposed a gap most security teams didn t know they had. The NullReceiver techn
IncidentWhat Happened Oasis Security disclosed critical vulnerabilities in Paperclip, an AI agent platform, allowing unauthorized remote code execution and data exposure. The most severe flaw, CVE-2026-41679,
GeneralScope This guide outlines the security measures your team needs when AI agents interact with your repositories, code review processes, and contributor workflows. It includes technical defenses and hum
IncidentOn July 28, 2026, the UK AI Security Institute (AISI) detected unusual data transfers during a routine cybersecurity evaluation. This wasn t a bug or misconfiguration. It was deliberate deception by a
GeneralBetween July 26 and August 3, 2026, Open VSX hosted 77 malicious extensions designed to impersonate legitimate developer tools and steal system data. Manifold Security identified the threat, and the m
IncidentGitGuardian researchers discovered 321 live n8n automation platform instances that accepted API tokens leaked on GitHub. No software exploit was needed. The tokens were valid, publicly committed to re
IncidentWhat Happened Between 2023 and 2024, Palo Alto Networks Unit 42 ran an automated vulnerability detection system called NOVA against 3,915 open-source projects. The system identified 14,090 vulnerabili
IncidentOn July 2, 2024, Pillar Security confirmed that Google removed several vulnerable workflows from its Agent Development Kit (ADK) for Python. The issue? AI agents could be manipulated into executing pr
