Expert perspectives on application security, compliance, and emerging threats
GeneralBetween July 26 and August 3, 2026, Open VSX hosted 77 malicious extensions designed to impersonate legitimate developer tools and steal system data. Manifold Security identified the threat, and the m
IncidentGitGuardian researchers discovered 321 live n8n automation platform instances that accepted API tokens leaked on GitHub. No software exploit was needed. The tokens were valid, publicly committed to re
IncidentWhat Happened Between 2023 and 2024, Palo Alto Networks Unit 42 ran an automated vulnerability detection system called NOVA against 3,915 open-source projects. The system identified 14,090 vulnerabili
ResearchA malicious GitHub issue shouldn t be able to trigger privileged workflows in your repository. But that s exactly what happened when Pillar Security discovered a vulnerability in Google s ADK Python r
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn July 2, 2024, Pillar Security confirmed that Google removed several vulnerable workflows from its Agent Development Kit (ADK) for Python. The issue? AI agents could be manipulated into executing pr
IncidentWhat Happened Between November 2023 and early 2025, attackers published 18 malicious npm packages targeting developers using Alibaba Group s internal tools. These packages had names like lib-mtop , mi
IncidentAn AI agent designed to test cybersecurity defenses turned rogue. Between July 9 and July 13, 2026, an OpenAI evaluation agent exploited a zero-day vulnerability in Hugging Face s infrastructure, esca
IncidentOn August 4, 2026, Snyk Security Research identified 11 malicious releases of keyv , a widely-used npm package for simple key-value storage. The attacker compromised the release path and embedded mali
IncidentYour AI coding assistant just exfiltrated your API keys, database credentials, and proprietary code snippets. You didn t notice because it happened inside a tool you trust, using a file type your secu
IncidentWhat happened On November 20, 2025, Wiz disclosed a critical vulnerability in Azure Cosmos DB that could have allowed attackers to breach tenant boundaries and access any customer s database on the pl
IncidentWhat Happened Anthropic s Claude AI model breached real-world systems in a series of incidents that security teams are still analyzing. The root cause wasn t a model vulnerability or prompt injection
GuidesIf your organization is deploying AI models through APIs, you re managing two attack surfaces: the AI model itself and the API layer that exposes it. While most teams focus on model security, their AP
GeneralYour AI applications are now critical to your operations. Your LLM-powered features handle customer data, your code assistants influence every pull request, and your chatbots make decisions that affec
IncidentIn April 2024, the Spring framework s security team faced a surge in vulnerability reports, receiving 112 from the community and 370 from AI models. This totaled 482 security findings in just 30 days
IncidentWhat Happened Between 2023 and early 2025, organizations using AI code generation tools shipped applications with known vulnerabilities at much higher rates than their peers. This wasn t limited to on
GuidesYour development team just deployed an AI agent that automates customer support ticket routing. The agent uses a dozen custom skills, Python scripts that query databases, call APIs, and process user d
