News
GitHub Gives Enterprises a Full Count of Who Holds the Keys
Tom Smith | | access management, agentic AI, AI coding agents, credential inventory, credential security, Developer Security, devsecops, github, GitHub Apps, GitHub Enterprise Cloud, identity security, least-privilege, OAuth tokens, PATs, Personal Access Tokens, secrets management, security operations, Software Supply Chain Security, SSH keysGitHub Enterprise Cloud now lets organizations export a full inventory of credentials, helping security teams identify stale, overprivileged and forgotten access across users, apps and automation ...
TeamPCP Supply Chain Attack Leads to CrowdSec Source Code Being Stolen
Jeff Burt | | CrowdSec, EDR, github, Mini Shai-Hulud, NPM security, OAuth tokens, supply chain attacks, TanStack compromise, TeamPCPCrowdSec says attackers stole source code from about 170 private GitHub repositories after a TanStack npm supply chain attack exposed an OAuth token tied to a former employee ...
Cycode Extends DevSecOps Reach to Software Packages Developers Download
Mike Vizard | | ADLC, agentic development lifecycle, AI coding agents, cool down period, Cycode, dependency security, Developer Security, devsecops, malicious packages, package security, software repositories, Software Supply Chain Security, supply chain attacks, threat intelligence, workstation protectionCycode is adding workstation-level protection to stop developers and AI coding agents from downloading malicious or insufficiently vetted software packages ...
Your AI Coding Assistant Has the Keys to the Repo. Z.ai Just Showed Why That Matters
Tom Smith | | AI coding assistants, AI Governance, AI security, Cloud Security, code security, Data Exfiltration, data privacy, Developer Security, developer tools, devsecops, egress monitoring, secrets management, shadow ai, Software Supply Chain, source code security, Z.ai, ZCode, Zhipu AIZCode’s default-on indexing feature reportedly uploaded entire developer workspaces to cloud storage, highlighting why AI coding assistants should be treated as privileged software and closely monitored ...
New npm Threat Bypasses Install Script Protections
A malicious npm package that has been downloaded millions of times comes with a new way of spreading the malware that makes it easier to bypass security protections, say researchers with security ...
GitLab Tightens Rate Limits as Coding Agents Drive Demand
GitLab is introducing new rate limits for its cloud-based DevOps platform as growing demand from AI agents and automated development tools increases pressure on its infrastructure. The changes, which begin October 19, ...
Codex Sandbox Escapes Show Why Agent Guardrails Can’t Live Inside the Agent
Tom Smith | | agentic AI, AI coding agents, AI security, application security, Codex CLI, Codex Desktop, Codex Security, coding agent security, Developer Security, devsecops, Heapjack, OpenAI Codex, Overpatch, sandbox escape, sandbox security, Software Supply ChainTwo patched OpenAI Codex vulnerabilities, Heapjack and Overpatch, exposed how coding agents can escape sandboxes and reach developer systems without approval prompts ...
Claude Code Adds AGENTS.md Fallback, Cutting Instruction File Sprawl
Tom Smith | | agentic AI, Agentic AI Foundation, AGENTS.md, AI coding agents, AI Development, AI Governance, Anthropic, Claude, Claude Code, coding agents, Cursor, developer tools, devops, Linux Foundation, OpenAI Codex, platform engineeringClaude Code now supports AGENTS.md, giving development teams a shared instruction format across multiple AI coding agents and reducing configuration drift ...
GitHub Separates Who Writes Code From Who Runs Your CI
Tom Smith | | Actions security, CI/CD security, devops, devsecops, github, GitHub Actions, GitHub Enterprise, GitHub security, pipeline security, pull_request_target, Repository Security, Software Supply Chain, supply chain security, workflow execution protections, workflow securityGitHub’s new workflow execution protections let teams control who and what can trigger Actions workflows, reducing CI/CD attack paths and tightening pipeline security ...
US District Court Decision in AI’s Favor Worries Open-Source Developers
A federal appeals court handed GitHub, Microsoft, and OpenAI an important win in the first major appellate ruling over how AI coding tools can use open-source code. As we all know, all ...
Splunk Open Sources Token Meter Tool for Application Developers
Mike Vizard | | agent monitoring, agentic AI, AI budgets, AI coding agents, AI cost management, AI costs, AI Development, AI FinOps, AI observability, Claude Code, Codex, coding assistants, Cursor, developer productivity, developer tools, devops, Kiro, MCP, Model Context Protocol, model costs, OpenCode, Pi, Splunk, token consumption, Token Meter, token usageSplunk’s open-source Token Meter gives developers real-time visibility into AI coding agent activity, token consumption and estimated costs across tools including Claude Code, Codex and Cursor ...
Anthropic Adds a Coordinator to Claude Projects for Running AI Work in Parallel
Tom Smith | | agentic AI, AI agents, AI coding agents, AI Development, AI project management, AI workflows, Anthropic, autonomous coding, Claude Code, Claude Projects, cloud development, code review, coding automation, developer productivity, developer tools, devops, Git branches, human-in-the-loop, multi-agent orchestration, parallel development, platform engineering, pull requests, software development, software engineeringAnthropic’s redesigned Claude Projects coordinates parallel Claude Code sessions, delegates work across branches and brings the results back through familiar pull-request review workflows ...
