The newest AI resources are on the AI page. For a reading order instead of a date order, see the AI learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-06-15 2026 | Leaking Secrets in the Age of AI intermediate 8 min read Secrets | Library for identifying AI-related secret leakage in public code repositories. The analysis found that `.ipynb` notebook files and configuration files like `mcp.json` and `.env` are particularly prone to exposing secrets from emerging AI vendors, impacting numerous companies. This research highlights critical gaps in current secrets scanning tools and practices, especially concerning the handling of AI development artifacts. → wiz.io |
| 2026-06-15 2026 | Why AppSec and CloudSec Belong Together in the Age of AI beginner 4 min read | Library for unifying application security (AppSec) and cloud security (CloudSec) in cloud-native environments, particularly with the rise of AI. It addresses workflow breakdowns and scattered responsibilities by fostering shared context, enabling automated ownership mapping, and integrating fixes directly into developer workflows. This approach aims to accelerate remediation and reduce real risk by tracing vulnerabilities from code to runtime, as demonstrated by findings such as exposed DeepSeek databases and RCE flaws in Ollama, alongside critical NVIDIA AI stack vulnerabilities. → wiz.io |
| 2026-06-15 2026 | NVIDIAScape - Critical NVIDIA AI Vulnerability: A Three-Line Container Escape in NVIDIA Container Toolkit (CVE-2025-23266) news 7 min read RCE | Library for detecting CVE-2025-23266, a critical NVIDIA Container Toolkit vulnerability allowing root access to the host machine through a three-line Dockerfile exploit. This flaw, dubbed #NVIDIAScape, impacts AI services across major cloud providers by enabling container escapes via misconfigured OCI hooks and abused environment variables like LD_PRELOAD. Affected versions include NVIDIA Container Toolkit up to v1.17.7 and NVIDIA GPU Operator up to 25.3.1. → wiz.io |
| 2026-06-15 2026 | What the U.S. AI Action Plan Means For Cyber Defenders news 4 min read | Survey of the U.S. AI Action Plan, detailing its emphasis on rapid AI innovation and infrastructure development, alongside a critical need for security foundations. The plan highlights initiatives like establishing an AI Information Sharing and Analysis Center (AI-ISAC), promoting secure-by-design principles, and developing AI incident response frameworks, acknowledging risks from adversarial threats and deepfakes. It urges secure development practices and continuous risk management for AI systems integrated into critical infrastructure and broader ecosystems. → wiz.io |
| 2026-06-15 2026 | Wiz Research Uncovers Critical Vulnerability in AI Vibe Coding platform Base44 Allowing Unauthorized Access to Private Applications news 8 min read AuthZ | Analysis of a critical vulnerability in the Base44 vibe coding platform, allowing unauthorized access to private applications. The issue stemmed from undocumented registration and email verification endpoints that accepted only a non-secret `app_id` value, bypassing authentication controls including SSO. This enabled attackers to create verified accounts for private applications, granting full access to sensitive data. Wiz Research responsibly disclosed the flaw, which was fixed within 24 hours. The vulnerability highlights systemic risks in AI-powered development platforms where a single flaw can jeopardize all applications built on the vendor's shared infrastructure. → wiz.io |
| 2026-06-15 2026 | Ultralytics AI Pwn Request Supply Chain Attack news 6 min read RCE Supply Chain | Writeup of the Ultralytics supply chain attack, detailing its two-phase execution between December 4-7, 2024. The attack leveraged template injection in GitHub Actions via a crafted branch name to exfiltrate secrets and distribute a Monero cryptocurrency miner (XMRig) through malicious PyPI releases. Affected versions included 8.3.41, 8.3.42, 8.3.45, and 8.3.46, which were available for brief periods before removal. → snyk.io |
| 2026-06-15 2026 | Securing GenAI Development with Snyk beginner 3 min read | Ebook detailing how to secure GenAI development with Snyk. It addresses the risks of AI-generated code, where up to 40% from tools like Copilot can contain security flaws, and the speed at which CVEs can be exploited. The ebook explains how Snyk Code, with its DeepCode AI and Snyk Agent Fix, offers in-IDE security, real-time scanning, AI-driven auto-fixing, and faster scans compared to traditional solutions, balancing productivity with robust security for both human-written and AI-generated code. → snyk.io |
| 2026-06-14 2026 | PromptSnatcher: AdBlocker stealing Ai Chats - 90k installs news 3 min read | Writeup on PromptSnatcher, a malicious operation involving two browser extensions with ~90k installs. These extensions, disguised as ad blockers, employ a custom engine to intercept and exfiltrate full AI conversations, model usage, and subscription tier data from platforms like ChatGPT, Claude, and Gemini. The operation uses legitimate filter lists as cover and a shared "Panel 231" SDK with identical obfuscated exfiltration logic and C2 infrastructure. Notably, Firefox variants falsely declare no data collection permissions while exhibiting the same data-stealing behavior as their Chrome counterparts. |
| 2026-06-14 2026 | Breaking NVIDIA Triton: CVE-2025-23319 - A Vulnerability Chain Leading to AI Server Takeover news 6 min read RCE | Writeup of CVE-2025-23319, a vulnerability chain discovered in NVIDIA's Triton Inference Server. This exploit begins with an information leak from the Python backend's shared memory name, which attackers can then leverage via the server's shared memory API to achieve arbitrary read/write capabilities. This allows for manipulation of internal data structures and IPC messages, potentially leading to remote code execution and complete server takeover, impacting model theft, data breaches, and network pivoting. → wiz.io |
| 2026-06-14 2026 | s1ngularity's Aftermath: AI, TTPs, and Impact in the Nx Supply Chain Attack advanced 9 min read Supply Chain | Analysis of the s1ngularity Nx supply chain attack details novel TTPs used by AI-powered malware to exfiltrate secrets, including GitHub and npm tokens. The attack progressed through three phases: initial public leakage of thousands of corporate secrets, abuse of leaked GitHub tokens to expose private repositories, and a final phase publishing more repositories. The malware leveraged AI CLIs like Claude and Gemini to identify and exfiltrate sensitive files, impacting over 1,700 users with public secret leakage and hundreds more through the exposure of private repositories. → wiz.io |
| 2026-06-14 2026 | AI Code Generation: Code Security & Quality, Benefits, Risks & Top Tools beginner 5 min read | Library for scanning AI-generated code, like that from GitHub Copilot or ChatGPT, for security vulnerabilities and quality issues. It acts as an AI security companion, using a hybrid AI approach combining machine learning with human-curated security knowledge to provide real-time identification of risks and actionable fixes, integrating seamlessly into development workflows to ensure secure adoption of AI coding tools. → snyk.io |
| 2026-06-14 2026 | AI Risk Management: Benefits, Challenges, and Best Practices beginner 4 min read | Library for AI risk management, outlining benefits like enhanced speed and accuracy with tools such as Snyk Code and Snyk AppRisk, which leverage DeepCode AI for vulnerability detection and auto-fixing. It addresses challenges like compliance complexities and tool selection, emphasizing secure-by-design principles and integration into development lifecycles. The library supports adherence to standards like NIST’s AI Risk Management Framework, promoting proactive security measures throughout AI development and deployment. → snyk.io |
| 2026-06-13 2026 | Show HN: Claw Patrol, a security firewall for agents news 1 min read | Library for controlling agent actions in production environments. Claw Patrol acts as a firewall between agents and production systems, parsing traffic and enforcing user-defined rules written in HCL. It can block potentially destructive actions like SQL commands or require human approval for Kubernetes resource deletions. The library supports multiple deployment configurations, including gateway proxy, per-process tunneling, and host-wide WireGuard tunnels, extracting facts for protocols like SQL, Kubernetes, and HTTP to evaluate conditions using CEL expressions. |
| 2026-06-13 2026 | The emerging use of malware invoking AI news 5 min read | Writeup on AI-invoking malware details incidents like LameHug, where malware prompts HuggingFace for commands; the Amazon Q Developer Extension compromise, which instructed an AI to clean systems; and s1ngularity, a supply chain attack using npm packages that attempted to leverage Claude, Gemini, and Q for credential theft. These campaigns highlight emerging threats where AI is used within payloads to potentially bypass detections or exploit trust in AI tools, with future concerns around agentic AI and the need for robust detection strategies. → wiz.io |
| 2026-06-13 2026 | Introducing zeroday.cloud: First-of-its-kind cloud and AI hacking competition news 2 min read | Competition hosting a cloud and AI hacking event with a $4.5 million bounty pool. Researchers can target vulnerabilities in categories like AI (Ollama, vLLM, NVIDIA Container Toolkit), Kubernetes (Kubernetes API Server, Kubelet Server, Grafana, Prometheus, Fluent Bit), Containers (Docker, Containerd, Linux Kernel), Web Servers (nginx, Apache Tomcat, Envoy, Caddy), Databases (Redis, PostgreSQL, MariaDB), and DevOps (Apache Airflow, Jenkins, GitLab CE). Successful exploits require total compromise, such as container/VM escape or 0-click RCE. The event partners with AWS, Microsoft, and Google Cloud, and will take place at Black Hat Europe in London. → wiz.io |
| 2026-06-13 2026 | AI Security 101: Mapping the AI Attack Surface beginner 4 min read | Library for mapping the AI attack surface, detailing risks from training data, model artifacts, AI pipelines, APIs, and shadow AI. It highlights real-world incidents like the 38TB Microsoft data exposure and the BingBang prompt injection vulnerability, offering practical steps to reduce risk, including mapping the environment, securing training data, hardening ML infrastructure, monitoring AI endpoints, and building shared ownership. → wiz.io |
| 2026-06-13 2026 | Securing AI Agents with Wiz AI-SPM intermediate 4 min read | Library for securing AI agents, Wiz AI-SPM, extends agentless CNAPP for visibility and continuous defense. It discovers AI services, models, and integrations; inventories AI software and dependencies via an AI Bill of Materials (AI BOM); maps attack surfaces; enforces secure configurations for platforms like Bedrock and Vertex AI; verifies guardrails; detects sensitive data exposure; correlates risks with identities and workloads; provides DSPM for AI; aligns with OWASP LLM risks; and offers runtime monitoring with automated response. → wiz.io |
| 2026-06-13 2026 | Empower and Accelerate Your SOC with the Blue Agent intermediate 4 min read | Tool for accelerating cloud threat detection and response, the Blue Agent integrates AI and the Wiz platform's context for automated threat investigation and triage. It mirrors Incident Response team expertise, presenting transparent reasoning and evidence to SOC analysts. The Agent correlates runtime signals, network telemetry, and cloud context, aiming to reduce manual triage and enable teams to focus on higher-value strategic work, ultimately scaling SOC operations without increasing headcount. → wiz.io |
| 2026-06-13 2026 | AI Threat Readiness Pillar 3: Perform AI Code Analysis Natively in Wiz intermediate 8 min read | Library for AI code analysis within Wiz, integrating native AI Code Scans with frontier models and agentic workflows. It addresses challenges of inconsistent coverage and alert fatigue in traditional SAST by prioritizing critical repositories via Code-to-Cloud mapping. The library employs a layered approach, combining rules-based SAST, continuous AI scans for semantic reasoning, and periodic deep analysis with frontier models. It enriches findings with the Wiz Security Graph and uses Red and Green Agents to validate exploitability and automate remediation. → wiz.io |
| 2026-06-13 2026 | Snyk Security Solution Now Integrated into Google Cloud's Gemini Code Assist intermediate 6 min read | Library integration enables developers to scan code for SAST, SCA, and IaC vulnerabilities directly within Google Cloud's Gemini Code Assist using natural language prompts. This streamlines the application security process by consolidating security checks within the IDE, reducing context switching and accelerating vulnerability detection and remediation with features like Snyk Agent Fix. The partnership allows for secure AI adoption at scale, providing enhanced developer experience and visibility into security risks across the software development lifecycle. → snyk.io |
| 2026-06-13 2026 | Snyk Ushers in the Future of DAST: AI-Driven Security for the Age of AI-Driven Development news 4 min read | Library for AI-driven dynamic application security testing (DAST), Snyk API & Web, redefines security for modern, AI-powered applications. Integrating Probely's DAST technology into its platform, it addresses complex APIs and Large Language Model (LLM) interactions, expanding coverage for OWASP Top 10 risks like BOLA. The solution offers holistic risk views, developer-first workflows, and synergistic detection by correlating DAST with SAST findings. Its roadmap includes AI-driven API testing and code-informed dynamic testing for enhanced vulnerability management. → snyk.io |
| 2026-06-13 2026 | Secure AI-Generated Code at Speed with Snyk and ServiceNow beginner 3 min read API Sec | Library integration between Snyk and ServiceNow streamlines application security for AI-generated code. This partnership offers developers real-time vulnerability detection and automated fixes for AI-generated code, custom code, and dependencies, reducing mean time to remediate by 84% with Snyk DeepCode AI. ServiceNow's workflows automate task assignment and tracking for AppSec teams, providing broad risk visibility and enabling efficient remediation. → snyk.io |
| 2026-06-13 2026 | Snyk @ RSAC 2025 news 3 min read API Sec | Library updates from RSAC 2025 highlight Snyk's advancements in application security, particularly concerning generative AI. The conference featured discussions on AI's impact on software security and Snyk's role in developing secure AI. Snyk API & Web received a Global InfoSec Award for Most Innovative API Security and was recognized as one of CRN’s 20 Coolest New Cybersecurity Products. Snyk also joined the Coalition for Secure AI (CoSAI) to promote secure and ethical generative AI development. The company also hosted a "Women Leading Security" panel to foster diversity and inclusivity in the industry. → snyk.io |
| 2026-06-13 2026 | Introducing the Snyk AI Security Platform beginner 8 min read | Platform that secures AI-powered development by integrating security directly into AI workflows. It introduces Snyk Assist for real-time secure coding guidance, Snyk Agent Fix for autonomous code remediation, Snyk Studio for integrating security into AI development platforms, and Snyk Guard for adaptive policy enforcement. The platform enhances visibility across AI applications, including API and web app security with AI-powered BOLA detection, and provides intelligent prioritization for identified vulnerabilities. → snyk.io |
| 2026-06-13 2026 | Welcome to Snyk Labs: Charting the Course for AI-Native Security beginner 2 min read | Library for AI-native security, Snyk Labs offers research, technical demos, and prototypes tackling new threats from LLMs and agents. It focuses on AI Security Posture Management (AI-SPM) and developing an AI Bill of Materials (AI BoM), alongside a GenAI Model Risk Registry. Snyk Labs also contributes to LLM security standards with OWASP and participates in initiatives like CoSAI. → snyk.io |
| 2026-06-13 2026 | Welcome-to-The New Era of AI-Driven Development beginner 2 min read | Analysis of AI-driven development security risks, including vulnerabilities in AI-generated code (48% of snippets) and issues from open-source AI tools (32% of developers face problems). This piece highlights package hallucination (over 5% of commercial AI code containing fake packages) and emphasizes the need for evolving security practices beyond traditional "shift left" methods to address the accelerated pace and increased risk introduced by AI coding assistants, advocating for the Snyk AI Trust Platform. → snyk.io |
| 2026-06-13 2026 | AI Is Reshaping Software. Is Your Security Strategy Keeping Up? beginner 4 min read | Framework for AI TrustOps, a readiness model evolving DevSecOps to address new risks from AI-generated code, LLMs, and agents, by focusing on governance, secure design, risk assurance, and culture to build and secure software responsibly without slowing innovation. → snyk.io |
| 2026-06-13 2026 | AI Trust in Action: How Snyk Agent Redefines Secure Development intermediate 6 min read | Library for AI-powered vulnerability remediation that blends hybrid AI with rigorous validation. Snyk Agent Fix combines a fine-tuned LLM with static analysis, including DeepCode AI and CodeReduce, to generate and verify fixes before presenting them to developers, achieving over 80% fix accuracy. It keeps customer code private and offers configurable policies for enterprise-grade security guardrails. → snyk.io |
| 2026-06-13 2026 | Build Fast, Stay Secure: Guardrails for AI Coding Assistants intermediate 6 min read | Library for integrating security into AI coding workflows, focusing on "guardrails" over restrictions. It highlights Snyk's capabilities, including pull request checks, IDE plugins for real-time scanning and auto-remediation, and conditional access controls via endpoint management tools like Microsoft Intune and Jamf, ensuring secure AI code generation from the start. The approach emphasizes developer-friendly adoption through incentives and education, rather than strict mandates. → snyk.io |
| 2026-06-13 2026 | Six levels, one lesson: LLMs cannot keep a secret beginner XSS | GitHub's Secure Code Game Season 3, a six-level browser-based challenge, demonstrates that LLMs cannot keep secrets. Each level features a vulnerable AI assistant with a hidden secret that players must extract by crafting prompt injection attacks. The game highlights that system prompts are not a reliable security layer for AI systems. → infosecwriteups.com |
| 2026-06-13 2026 | Full Fathom Five: The context of Anthropic’s Mythos-class public release intermediate 6 min read AuthZ | Library for understanding Anthropic's Claude Fable 5 release, clarifying it's not a direct Mythos Preview access but a similarly capable model routed to Opus 4.8 for cybersecurity queries. It argues against focusing solely on CVEs and vendor vulnerabilities, highlighting that misconfigurations, stale permissions, and broken identity edges represent 80% of the security challenge and are the true targets for defensive AI investments, not an "AI hacker" scenario. → aikido.dev |
| 2026-06-13 2026 | KCD New York 2026: Trust, Agents, and the Work Behind the Work news 8 min read API Sec AuthZ | Library summarizing Kubernetes Community Days New York 2026, focusing on "Zero Trust for APIs" with Istio Ambient Mesh, the complexities of Kubernetes CVEs and AI vulnerability assessment, and autonomous multi-cluster remediation using agentic AI and MCP servers. It also highlights the importance of community in open-source infrastructure, referencing the New Contributor Orientation program. → blog.gitguardian.com |
| 2026-06-12 2026 | Fable 5 and the analyst-AI threat model: what a Mythos-class model changes for security work advanced | This content discusses how a "Mythos-class model" for analyzing AI threats, as applied to Fable 5, fundamentally alters security work. It emphasizes a shift in how security professionals approach understanding and mitigating risks associated with AI systems. The core idea is that this new modeling approach provides a more comprehensive and potentially proactive way to identify and address vulnerabilities inherent in AI development and deployment. |
| 2026-06-12 2026 | Detecting AI-specific threats in Claude Enterprise from the Compliance API: a prefilter + LLM-as-judge pipeline with Sigma rules intermediate 11 min read | Library for detecting AI-specific threats within Claude Enterprise, leveraging the Compliance API through a prefilter and LLM-as-judge pipeline with Sigma rules. It focuses on detecting indirect prompt injection via ingested content, jailbreaks, system prompt extraction, exfiltration preparation, and sensitive output disclosure, differentiating these threats from standard SaaS security concerns by analyzing conversation content rather than just perimeter events. |
| 2026-06-12 2026 | Prompt injection: attacking the analyst's AI intermediate | This content focuses on "prompt injection," a cybersecurity attack targeting AI models used by analysts. Prompt injection involves manipulating the input given to an AI system to make it perform unintended actions or reveal sensitive information. Essentially, attackers craft malicious prompts that exploit vulnerabilities in how the AI processes and interprets instructions. The goal is to bypass the AI's safety mechanisms or security controls, potentially compromising the analyst's workflow and the data they access. |
| 2026-06-12 2026 | Hacking Google with A.I. for $500,000 news 53 min read | Writeup detailing the process of using AI to fuzz Google APIs, focusing on leveraging Google's discovery documents. The approach involves mass collection of API keys by scraping APKs and intercepting network traffic, filtering them using the Cloud Marketplace API, and identifying live Google API domains. It further explains how to discover hidden endpoints by probing with visibility labels and discusses challenges with authentication, particularly noting the effectiveness of First Party Authentication (FPA) with API keys. |
| 2026-06-12 2026 | A €0.01 bank transfer could compromise a banking AI agent intermediate | A €0.01 bank transfer can exploit vulnerabilities in banking AI agents. This minimal amount allows attackers to test the AI's ability to process transactions, potentially revealing weaknesses in its security protocols. The study highlights that even seemingly insignificant actions can have severe security implications for AI systems used in finance. |
| 2026-06-12 2026 | From MCP to Vibe Coding: Full Endpoint Visibility in Wiz AI Security beginner 3 min read | Library for full endpoint visibility in AI Security, powered by Wiz Attack Surface Scanner. It surfaces live, validated AI endpoints including Vibe Coding, AI Pipelines, AI as a Service, AI Frameworks & Toolkits, AI Models, AI Security, and MCP Endpoints. The library ties these into the Security Graph to show data, identities, and workloads, enabling direct exploration, tracing to underlying workloads, and end-to-end response from discovery to remediation. It aligns with security best practices like OWASP Top 10 for LLMs. → wiz.io |
| 2026-06-12 2026 | The New Threat Landscape: AI-Native Apps and Agentic Workflows beginner 3 min read | Survey of AI-native application threats including data poisoning, prompt injection, and federated identity gaps, highlighting risks from AI agents and their integration into enterprise software. Discusses vulnerabilities in LLMs and emerging components, the need for secure development workflows, and the challenges in monitoring AI's unpredictable behavior. Mentions Anthropic's Model Context Protocol (MCP) as a standardization effort and Gartner's predictions for AI adoption in enterprise applications and agentic AI integration. → snyk.io |
| 2026-06-12 2026 | Building AI Trust with Snyk Code and Snyk Agent Fix beginner 6 min read | Library for AI-assisted application security, Snyk Code integrates SAST with Snyk Agent Fix, an AI-powered auto-remediation assistant. Snyk Agent Fix generates and validates code fixes autonomously within IDEs and pull requests, boasting 80% accuracy with patented CodeReduce technology. This reduces manual remediation time from hours to seconds, ensuring human- and AI-generated code is secured early in the development lifecycle, with enhanced visibility, prioritization, and policy enforcement capabilities. → snyk.io |
| 2026-06-12 2026 | Scan your AI-generated code from Cursor using Model Context Protocol (MCP) beginner 1 min read | Library for real-time vulnerability detection within Cursor, leveraging Snyk's CLI MCP server for zero-setup interoperability with AI-generated code. This integration enables immediate identification of security issues in code and open-source packages as they are generated, facilitating agile development cycles without compromising security. → snyk.io |
| 2026-06-12 2026 | Cursor IDE Malware Extension Compromise in $500k Crypto Heist news 3 min read Supply Chain | Writeup on the Cursor IDE malware extension compromise, detailing how a malicious "Solidity Language" extension distributed via the Open VSX Registry led to a $500,000 cryptocurrency heist. The attack involved the extension executing a PowerShell script to exfiltrate assets after installation. → snyk.io |
| 2026-06-12 2026 | When “Private" Isn't: The Security Risk of GPT Chats Leaking to Search Engines beginner 3 min read Secrets | Writeup on the security risk of LLM chats, specifically the ChatGPT "discoverable links" feature that unintentionally exposed sensitive user conversations to search engines like Google and Bing in July 2025. This incident, similar to past issues with Google Bard, highlights the dangers of insecure defaults and insufficient UI consent, leading to unintentional exposure of personal data. Mitigation strategies include disabling search engine discoverability by default, improving UI labeling, applying noindex headers, and organizations deploying enterprise-grade LLMs with DLP tools. → snyk.io |
| 2026-06-12 2026 | Secure at Inception: Introducing New Tools for Securing AI-Native Development beginner 6 min read Supply Chain | Library introducing three free capabilities to secure AI-native development: Snyk's MCP Server for embedding security into agentic workflows with tools like Cursor and Co-Pilot, Snyk AI-BOM for discovering and governing AI components, and Toxic Flow Analysis (TFA) for detecting novel attack vectors in AI applications, addressing vulnerabilities like prompt injections and MCP rug pulls. → snyk.io |
| 2026-06-12 2026 | From Ideas to Impact: How the Bay Area Is Shaping the Future of Secure AI beginner 4 min read | Framework for AI readiness, developed by Snyk, offers five pillars: visibility, ownership, secure design, cultural enablement, and continuous assurance. This framework addresses the evolving landscape of AI-powered systems, emphasizing shared accountability and the need for integrated security throughout the development lifecycle. Sessions at Snyk's Lighthouse event highlighted practical strategies for agentic app development, real-time risk modeling, and upskilling teams, with live demonstrations showcasing how tools like Cursor and Snyk can reduce security fix times from hours to minutes. The framework aims to accelerate responsible AI adoption by building trust and implementing smart guardrails from the outset. → snyk.io |
| 2026-06-12 2026 | Meeting the AI Mandates with Confidence: Why Federal Teams Trust Snyk beginner 3 min read | Platform for securing AI development by federal agencies, Snyk helps teams meet new mandates by identifying and fixing vulnerabilities at scale. It integrates with existing workflows and provides credible vulnerability intelligence sourced from CVE and CWE. Key features include Snyk Agent Fix for automated remediation, Snyk Assist for real-time developer support, and support for AIBOMs and Toxic Flow Analysis to address complex AI-specific vulnerabilities like indirect prompt injection. → snyk.io |
| 2026-06-12 2026 | Agentic Container Security with Snyk MCP Server beginner 4 min read Supply Chain | Library for agentic container security, Snyk MCP Server simplifies vulnerability scanning by integrating with AI coding assistants and IDEs. This tool addresses container security challenges by enabling "shift left" practices, allowing developers to identify and fix Common Vulnerabilities and Exposures (CVEs) and operating system vulnerabilities before committing code. Snyk MCP Server supports scanning container images for OS vulnerabilities and vulnerable open-source application packages, and can be configured within tools like Cursor and Copilot. → snyk.io |
| 2026-06-12 2026 | AI Agents in Cybersecurity: Revolutionizing AppSec beginner 5 min read | Framework for integrating AI agents into cybersecurity operations, detailing their autonomous decision-making, continuous learning, and multi-modal data processing capabilities. It contrasts AI agents with traditional AI, highlights their role in transforming threat detection and incident response, and addresses implementation challenges like blind spots and explainability, referencing frameworks like BDI, Langchain, and CrewAI to foster human-AI collaboration. → snyk.io |
| 2026-06-12 2026 | Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security Incident news 6 min read Supply Chain | Analysis of the Nx malicious package incident, detailing how threat actors weaponized AI coding agents like Claude Code, Gemini CLI, and Amazon's q with dangerous flags to exfiltrate secrets, credentials, and sensitive data via public GitHub repositories. The attack exploited a flawed GitHub Actions CI workflow and a compromised npm token to inject malware into eight Nx and Nx Powerpack releases on npm, impacting the Nx Console VS Code extension as well. → snyk.io |
| 2026-06-12 2026 | Securing the uncharted territories of AI systems. A discussion with Leo Racanelli beginner 9 min read | Library of findings for AI security, featuring insights from Leo Racanelli, details novel vulnerabilities introduced by AI applications, including risks from natural text input exceeding traditional sanitization methods. It highlights the appeal of AI-inclusive bug bounty programs, the impact of AI as a collaborative workflow partner for researchers, and the importance of building a knowledge base to identify systemic flaws. The library serves to document findings and non-bug leads, enabling future threat hunting and cross-referencing of similar vulnerabilities. → intigriti.com |