Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened A development team using LLM-assisted code generation released multiple pull requests containing hardcoded API keys, database credentials, and overly permissive access controls. The code
GeneralScope This guide focuses on identity-based security controls for AI agents that autonomously execute code, move data, and provision infrastructure. You ll learn how to implement lifecycle governance f
ResearchA Harvard Business School study tracking GitHub activity reveals something your security team needs to see: developers using Copilot increased their coding time by 12.4%, while their project managemen
IncidentWhat Happened Researchers found that AI coding agents can follow hidden instructions in project README files, even if those instructions lead to data leaks. In tests using ReadSecBench, a specialized
Get weekly security insights and compliance updates delivered to your inbox.
GeneralChainguard just released OS Packages, and the timing matters. While your team patches CVE manually, AI-generated code is shipping faster than your security reviews can keep up. The gap between develop
GeneralThe Conventional Wisdom Security teams are rushing to implement tamper-evident logging for AI agents. The logic seems sound: hash-chained logs prevent modification, cryptographic signatures prove auth
GeneralYour static analysis tools scanned clean. Your code review passed. Your deployment went live. And somewhere in a shopper s browser, a payment skimmer just activated from metadata hidden inside a favic
GeneralThe Conventional Wisdom Your compliance team needs an SBOM. The EU Cyber Resilience Act demands it. Executive Order 14028 requires it. Every vendor pitch deck promises that generating and managing Sof
StandardsThe OWASP Top 10 for LLM Applications got a major update in late 2024. Unlike the classic OWASP Top 10 for web apps, this framework addresses risks unique to large language models: prompt injection, d
ResearchResearch presented at RSAC 2026 highlights a significant issue: Model Context Protocol (MCP) introduces architectural vulnerabilities in LLM environments that can t be resolved with patches. Unlike a
GeneralDebian developers recently voted to encourage, but not require, disclosure of AI assistance in code contributions. The decision was to make disclosure voluntary, with mandatory human review of AI-gene
GeneralYou ve probably heard the predictions: AI will make us abandon human-readable code for machine-optimized languages. We ll all be writing in some new AI-first syntax by 2027. Your investments in Rust a
GeneralThe Conventional Wisdom Your compliance team wants to know if the AI model you re deploying is secure. Your vendor shows you certifications. Your engineers run penetration tests against the model s AP
Vendor NewsYour open source project just received 47 security reports this week. Twelve came from the same AI tool. Six are duplicates. Three describe features, not bugs. Somewhere in that pile might be a critic
IncidentIncident Overview An AI-powered customer service system fell victim to a malicious prompt that extracted internal knowledge base content and exposed it to an unauthorized user. The attack succeeded be
GeneralIf you re building agentic AI systems, you ve probably considered an MCP Gateway as your security layer. Don t. While the abstraction looks clean on architecture diagrams, it creates more problems tha
