Continuous Testing
‘HalluSquatting’ Compromises AI Coding Agents to Install Malware, Create Botnets
Jeff Burt | | AI coding agents, AI hallucinations, AI security agents, Cursor, devops, GitHub Copilot, Google Gemini, HalluSquatting, indirect prompt injection, LLM, OpenClaw, promptwareHallucinations have been an ongoing problem since OpenAI first introduced its ChatGPT chatbot in November 2022, highlighting generative AI’s tendency to generate plausible but false or misleading information and its inability to ...
How to Build a DevSecOps CI/CD Pipeline on Azure With GitHub Actions
Fix security problems when they’re cheap to fix, which is before the code is deployed. A pipeline that enforces this automatically is what makes that principle real ...
North Korea Expands the Reach of PolinRider Supply Chain Attack Campaign
Jeff Burt | | AI supply chain attacks, APT37, Chrome Store, Contagious Interview, devops, devsecops, Famous Chollima, Go modules, Lazarus Group, malicious npm packages, North Korea, package registry malware, Packagist, PolinRider, Rescana, Socket, supply chainThe North Korean-sponsored threat groups behind the long-running fake interview scams targeting developers are expanding the PolinRider supply chain campaign that has escalated over the past several months. Reports from cybersecurity vendors ...
‘GitLost’ Flaw Lets Attackers Trick GitHub AI Agent Into Leaking Private Repos
Jeff Burt | | Acalvio, agentic AI guardrails, AI security, Anthropic Claude, Forcepoint, GitHub Agentic Workflows, indirect prompt injection, LLM, Markdown, Microsoft Copilot, Noma Security, private repository, public repositoryNoma researchers again show how easy it is to manipulate AI agents with malicious commands via indirect prompt injection attacks ...
Novee Uncovers Cordyceps: The Latest Threat to CI/CD Pipelines
Jeff Burt | | AI coding agents, apache, CI/CD security, Cloudflare, code repositories, Cordyceps, GitHub Actions, google, microsoft, Novee, npm malware, PyPi, Python, supply chain attacks, WizA newly discovered supply chain security flaw is once again putting a spotlight on inherent weaknesses in CI/CD pipelines and the growing interest among cyberthreat actors to exploit them. Security researchers with ...
Your AI Testing Framework Might Be Passing Tests It Should Be Failing
Engineering teams are not evaluating whether AI belongs in their testing workflows anymore, but are discovering, sometimes painfully, that the architectural decisions they made when integrating it are the ones that will ...
Security Flaw in Claude Code Illustrates the Risk of AI in Developer Workflows
Jeff Burt | | agentic AI in development, Anthropic Claude Code, bash, CI/CD and AI agents, exposed secrets, GitHub Actions, microsoft, prompt injectionAI coding agents are reshaping software development—but they’re also expanding the attack surface. Researchers uncovered a now-patched vulnerability in Anthropic’s Claude Code GitHub Action that could have enabled prompt injection attacks to ...
SmartBear Adds Computer Vision Capability to Testing Platform
SmartBear this week extended its ability to apply artificial intelligence to application testing with the addition of a computer vision capability that can be used to detect objects in applications. Prashant Mohan, ...
Why DIY Test Automation Succeeds Its Way Into a Problem
Rohit Raghuvansi | | AI Development, DIY Test Automation, Quality Engineering, software testing, test automationAsk any engineering team if they can build their own test automation framework, and the answer is almost always “yes.” With modern AI tools involved, that answer arrives faster and with more ...
Regression Testing Tools in the Age of AI-Assisted Development: What Has Changed
Sophie Lane | | AI-assisted development, devsecops, regression testing tools, software testing, test automationFor most of the past decade, the conversation around regression testing tools was fairly stable. The tools got faster, the integrations got smoother, and the underlying approach stayed largely the same: write ...
Observability-Driven Continuous Testing in Cloud-Native DevOps
Observability transforms continuous testing from quality gates into reliability signals. Cloud-native teams ship faster because they know their systems better — traces reveal bottlenecks, synthetics catch regressions and security telemetry prevents breaches. ...
North Korean Hackers Suspected in Supply Chain Attack on Popular Axios Project
Jeff Burt | | Axios, CI/CD, Google Threat Intelligence Group, JavaScript dependencies, Mandiant, North Korea, remote access trojan (RAT), Socket, sonatype, supply chain attack, TeamPCPThe threat actor targeted a highly popular open source project with more than 100 million weekly downloads, creating a large "blast radius." ...
