Articles & News

A support agent cannot export customer records. A reporting agent can. Through delegation, the restricted agent gets there anyway.

Muse isolates each agent and gates actions outside the model. That answers where the agent runs. Once you build on it, the question is what it can reach.

Most AI inventories describe intent, not execution. Why guardrails, agents and models have to be read from the running process to be governed.

Kodem Security joins OpenAI's Daybreak, putting frontier reasoning inside the runtime system that discovers, governs, protects, and responds across apps and AI agents.

JFrog Artifactory vulnerability chain CVE-2026-82329, CVE-2026-42018 and CVE-2026-42016 reached admin in under five minutes. Affected versions, IOCs, runbook.

Malicious package detection is not CVE scanning. Five tools compared on detection latency, ecosystem tiering, and whether they block or only alert.

AI SAST tools promise less noise and automatic fixes. Five tools compared on the six criteria that matter, and what the independent research shows.

CVE-2026-78676 turns dormant git-config values into live core.hooksPath directives on any GitPython write. Affected versions, the 3.1.59 fix, and the runbook.

scrambleeeer and scrambleeer hid a PyPI reverse shell that fires on library use, not install. Get the affected versions, the IOCs, and the first-hour runbook.

The EU delayed high-risk AI obligations to 2027 and 2028, then switched on enforcement. Here is what 2026 AI regulation actually requires, and why most of it comes down to what your agents can reach.

The US made secure development attestation optional in January. The EU starts enforcing 24 hour vulnerability reporting in September. Here is what 2026 actually requires, and what it asks you to prove.

Runtime security uses evidence from a running application to decide which risks are real. How it differs from static analysis, SCA, WAF and RASP, and where it stops.

The keyv supply chain attack poisoned 11 npm seed packages and spread a Shai-Hulud worm to 400+ more. Get affected versions, IOCs, and the first-hour runbook.

Open-weight models cut inference costs by 60 to 90 percent. They also turn AI into infrastructure the security team has to discover, secure, and continuously verify.

OpenAI's models escaped a sandbox and hacked Hugging Face mid-evaluation. What that means for how application security has to work next.

Syntax correctness passed 95%. Security pass rates are still stuck near 55%.

Reachability tells you code can execute. Runtime tells you it did.

We found a vulnerability in Kiro, AWS's agentic IDE, that breaks this promise. By planting hidden instructions in a web page Kiro reads, an attacker can make Kiro rewrite its own MCP (Model Context Protocol) server configuration file and gain arbitrary code execution on the developer's machine.

An LLM jailbreak bypasses a model's safety guardrails to produce restricted output. How jailbreaks work, how they differ from prompt injection, and defenses.

RAG security covers the risks of retrieval-augmented generation: injection through retrieved content, data poisoning, and leakage. The threats and how to defend.

MCP security covers the risks of the Model Context Protocol connecting AI agents to tools and data. The main threats, and how to contain them at runtime.

A software bill of materials (SBOM) inventories every component in your software. What an SBOM includes, why it matters, and how runtime makes it actionable.

Server-side template injection (SSTI) lets user input run in a template engine, often escalating to RCE. How SSTI works, and how to prevent and detect it.

Remote code execution (RCE) lets an attacker run code on your system. How RCE attacks work, what causes them, and why runtime reachability decides which ones matter.

A stolen GitHub token let an attacker publish four backdoored @asyncapi packages through AsyncAPI's own release pipeline. Get the attack chain, IOCs, and first-hour response runbook.

Kodem AI-BOM extends your SBOM with an AI bill of materials: identify AI packages, verify runtime execution, and govern AI supply chain risk at scale.

Discover the key security issues in Scala, explore critical CVEs, and learn best practices to secure your Scala applications against vulnerabilities.

Malicious @injectivelabs/sdk-ts 1.20.21 stole wallet keys via a fake npm telemetry hook. See affected versions, IOCs, and the response runbook.

Veracode's 45% AI code stat is everywhere. Here's why knowing which flaw actually ran matters more than the number.

EPSS estimates the probability a CVE will be exploited in the next 30 days. How it works, how it compares to CVSS and KEV, and how to prioritize with it.