Tag: AI security
Critical Flaw in isolated-vm Can Lead to Sandbox Escape, RCE Threat
Jeff Burt | | Activepieces, AI security, C/C++, Endor Labs, isolated-vm, JavaScript security, Mastra, n8n, Node.js security, remote code execution, Sandbox, software vulnerability, TOCTOU, V8 Isolate, vm2Developers for years have been using vm2, an open-source Node.js library, to run untrusted JavaScript inside a secure and isolated sandbox environment. It uses Node.js’s built-in modules and JavaScript Proxies and lets ...
What the Microservices Era Can Teach Us About AI
Mark Fussell | | agent identity, agent observability, agent runtime, agentic AI, agentic durable execution, AI agents, AI architecture, AI Governance, AI infrastructure, AI security, autonomous agents, cloud-native AI, distributed systems, durable execution, LLM observability, microservices, Open Standards, platform engineering, vendor lock-in, workflow orchestrationAI agents are not just microservices with LLMs attached. Their long-running, non-deterministic workflows demand durable execution, per-step identity, governance and observability ...
Anthropic Makes Claude Code’s Auto Mode the Default, Betting Automation Beats Manual Review
Tom Smith | | agent permissions, agentic coding, AI code generation, AI coding agents, AI Governance, AI guardrails, AI permissions, AI safety, AI security, Anthropic, autonomous coding agents, Claude Code, Claude Code auto mode, Claude Code security, coding automation, developer productivity, developer tools, human engineering the loop, human-in-the-loop, permission fatigue, prompt injection, Pull Request Automation, secure AI agents, software development, software engineeringAnthropic is making Claude Code’s auto mode the default for Pro, Max and Team users, replacing constant permission prompts with classifier-based guardrails designed to catch risky actions without slowing developers down ...
Open Source Code Just as Secure as Proprietary Software—If You Manage It Right, Says CISA
Joab Jackson | | AI security, CISA, federal government, open source software, Software Supply Chain, vulnerability managementOpen source can be just as safe as proprietary software, though government agencies (and private enterprises) should take additional measures to secure it properly, according to a new guide published by the ...
‘GitLost’ Flaw Lets Attackers Trick GitHub AI Agent Into Leaking Private Repos
Jeff Burt | | Acalvio, agentic AI guardrails, AI security, Anthropic Claude, Forcepoint, GitHub Agentic Workflows, indirect prompt injection, LLM, Markdown, Microsoft Copilot, Noma Security, private repository, public repositoryNoma researchers again show how easy it is to manipulate AI agents with malicious commands via indirect prompt injection attacks ...
From Phishing to Vishing: Why DevSecOps Must Rethink Communication Security
Key Takeaways: Vishing is the new frontline threat: Attackers are shifting from emails to phone-based scams, using AI and social engineering to bypass traditional security controls. DevSecOps must expand its scope: Securing ...
Still Using API Keys for Your AI Agent? Here’s When it’s Time to Upgrade
Rishi Bhargava | | agent security, agentic AI, AI agent, AI Governance, AI security, API Keys, identity and access management, OauthAPI keys got you here. They won’t get you where you’re going. OAuth isn’t a future upgrade. It’s the foundation your agents should have been built on from the start. ...
Agentic DevSecOps: AI Security Co-Pilots for Your CI/CD Pipeline
Joydip Kanjilal | | agentic AI, AI copilots, AI Governance, AI incident response, AI pipeline management, AI security, AI security agents, AI threat detection, AI vulnerability scanning, AI-driven security, AI-powered DevSecOps, application security, autonomous AI agents, autonomous security testing, CI/CD security, Cloud Security, continuous security monitoring, cybersecurity automation, devops security, devsecops, devsecops automation, infrastructure security, intelligent automation, real-time threat intelligence, SDLC security, Secure software delivery, security automation, security operations, security orchestration, security posture management, software development lifecycle, software security, threat remediationThe emergence of AI has brought endless possibilities and innovative opportunities in today’s ever-changing, fast-paced technology landscape. AI is helping development teams produce software significantly faster than ever before. AI-enabled DevSecOps tools ...
LayerX: Anthropic’s Claude Code Can Easily Be Easily Weaponized
Jeff Burt | | agentic AI guardrails, AI Developers, AI IDE, AI security, Anthropic Claude Code, Anthropic Mythos Preview, LayerX, Project GlasswingLayerX researchers were able to convince the popular AI coding tool to bypass its guardrails and execute malicious instructions ...
Lessons from 2025: The Year “Agent Mitigation” Became a Thing
Abigail Wall | | Agent Mitigation, AI agents, AI Best Practices, AI security, cloud infrastructure, Continuous Evaluation, Data Exfiltration, Environment Orchestration, Incident Analysis, incident management, incident response, Mitigation Strategies., Public APIs, reliability engineering, risk management, Security ControlsExplore the emergence of agent mitigation as a formal discipline in response to 2025's AI failures, highlighting best practices for secure and reliable AI agent deployment ...
Surprise! Everybody Uses AI Tools for Software Development, Few Do So Securely
Teri Robinson | | AI security, AI-generated code, appsec, code security automation, Dependency Management, devsecops, SBoM, secure coding, software supply chain riskAI is generating code faster than teams can secure it, widening software supply chain risk and exposing major gaps in AppSec and governance ...
VS Code Pushes Hard on AI Agents While Quietly Killing Free Code Completion
Tom Smith | | Agent HQ, Agent Sessions, agentic coding, AI agents, AI code completion, AI security, developer tools, devops, GitHub Copilot, IDE updates, IntelliCode deprecation, microsoft, prompt injection, software development, TypeScript 7, TypeScript Go compiler, Visual Studio Code, VS Code updateMicrosoft's VS Code update brings Agent HQ, TypeScript 7 preview, and kills free IntelliCode. What developers need to know about the latest changes ...
