The newest AI resources are on the AI page. For a reading order instead of a date order, see the AI learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-06-22 2026 | Boosting efficiency with Wiz's AI-driven remediation steps powered by Amazon Bedrock news 2 min read | Integration leveraging Amazon Bedrock provides AI-driven remediation guidance to enhance security and reduce mean time to remediate (MTTR). This solution analyzes Wiz Issues, which detect risks like vulnerabilities and misconfigurations, and generates actionable, copy-paste remediation steps for tools such as CLI, Terraform, and CloudFormation, empowering both security teams and developers to address risks efficiently. → wiz.io |
| 2026-06-22 2026 | 4 Advantages of using AI code review beginner 5 min read | Library for AI-powered code review that augments manual efforts to identify security vulnerabilities, performance bottlenecks, and code smells. It enhances Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) by analyzing vast codebases rapidly, reducing human error, and boosting developer productivity. Techniques like deep learning and pattern recognition help find known and unknown issues, with a human-in-the-loop approach to minimize false positives and negatives, exemplified by Snyk Code's AI semantic analysis. → snyk.io |
| 2026-06-22 2026 | Nightfall AI and Snyk unite to deliver AI-powered secrets scanning for developers news 2 min read Secrets | Library integrating Nightfall AI's advanced secrets scanning with Snyk's developer security platform. This partnership enables automated detection of PII, PHI, PCI, API keys, and other sensitive data across cloud environments and AI-generated code. Nightfall's AI-native capabilities offer over 100 data type detectors, context-aware alerts to reduce false positives, and developer-centric remediation, enhancing Snyk's ability to secure the software supply chain and application security posture. → snyk.io |
| 2026-06-21 2026 | The risk in malicious AI models: Wiz Research discovers critical vulnerability in AI-as-a-Service provider, Replicate news 7 min read | Library detailing a critical vulnerability in Replicate, an AI-as-a-service provider. The vulnerability, discovered by Wiz Research, allowed for remote code execution via a malicious Cog container. This RCE enabled attackers to access a shared Redis instance, then use TCP injection via tools like `rshijack` to bypass authentication and inject Lua scripts. These scripts could modify customer prompts and redirect webhook notifications, potentially leading to cross-tenant data leakage and interference with AI model predictions. → wiz.io |
| 2026-06-21 2026 | Wiz AI-SPM model scanning: Securely innovate with AI community models beginner 5 min read | Library for scanning hosted AI models, including PyTorch and Tensorflow formats sourced from Hugging Face or elsewhere. This library detects malicious models, such as those using pickle files for arbitrary code execution, and provides visibility into AI pipelines with an AI Bill of Materials (AI-BOM). It addresses supply chain risks associated with open-source models and offers runtime protection against suspicious model behavior. → wiz.io |
| 2026-06-21 2026 | Probllama: Ollama Remote Code Execution Vulnerability (CVE-2024-37032) – Overview and Mitigations news 6 min read RCE | Writeup on CVE-2024-37032, "Probllama," a Remote Code Execution vulnerability in Ollama. Discovered by Wiz Research, the flaw stems from insufficient input validation in the `/api/pull` endpoint, allowing path traversal for arbitrary file writes. This can be further exploited for arbitrary file reads and ultimately RCE, particularly in Docker installations where Ollama runs with root privileges. The writeup details the exploit chain, including overwriting `/etc/ld.so.preload` to achieve RCE. Users are advised to upgrade to Ollama 0.1.34 or newer, and deployments should implement authentication via a reverse proxy due to the lack of built-in authentication in Ollama. → wiz.io |
| 2026-06-21 2026 | SAPwned: SAP AI vulnerabilities expose customers’ cloud environments and private AI artifacts news 7 min read API Sec | Library for auditing SAP AI Core, exposing a vulnerability chain dubbed "SAPwned." This chain allows arbitrary code execution within SAP AI Core pods, bypassing network restrictions via `shareProcessNamespace` and `runAsUser`. Exploitable findings include leaked AWS tokens from Loki, unauthenticated EFS shares with customer AI data, and an unauthenticated Helm server compromising internal Docker registries and Artifactory. The Helm server also provides cluster-admin privileges on the Kubernetes cluster, enabling access to customer secrets, cloud credentials for AWS and Azure, and private AI artifacts. → wiz.io |
| 2026-06-21 2026 | How to choose a security tool for your AI-generated code beginner 8 min read | Guide on selecting security tools for AI-generated code, emphasizing real-time IDE analysis powered by Snyk's DeepCode AI, accurate risk management avoiding AI hallucinations through hybrid AI and human oversight, thorough interfile analysis of entire applications, and automated in-platform reporting for compliance. The guide highlights Snyk's approach to secure development workflows for generative AI. → snyk.io |
| 2026-06-21 2026 | 3 tips from Snyk and Dynatrace’s AI security experts beginner 4 min read | Talk from Snyk and Dynatrace AI experts highlights three key takeaways for secure generative AI adoption. Prioritizing AI governance, involving cross-functional teams for ethics, request ingestion, and communication is crucial. Taking a patient and considered approach to new technologies is advised, with a focus on understanding data flow, explainability, and transparency in AI tools. Finally, balancing AI opportunities with risks in development necessitates rigorous code security practices, including threat management scanning and clear documentation of AI-generated code, to avoid vulnerabilities and data overexposure. → snyk.io |
| 2026-06-21 2026 | Snyk & Atlassian: How to embed security in AI-assisted software development beginner 4 min read | Library that integrates with AI-assisted development to address risks from tools like GitHub Copilot and Amazon CodeWhisperer. It scans AI-generated code in real-time within the IDE, flagging vulnerabilities stemming from bad training data or hallucinations, and provides quick fixes. The library is presented as a method to verify code against known standards, ensuring trust and security are embedded throughout the SDLC, much like safety measures on a construction site. → snyk.io |
| 2026-06-20 2026 | Essential AI Tools to Boost Developer Productivity and Security beginner 5 min read | Library that categorizes AI developer tools, highlighting Security Companions like Snyk Code for real-time analysis of AI-generated and developer-written code. It also details Coding Assistants (GitHub Copilot, Amazon CodeWhisperer), Chatbots/LLMs (ChatGPT, Claude.AI), AI code search (Sourcegraph, Phind), and AI code testing (Codium), emphasizing the need to pair coding assistants with security tools. → snyk.io |
| 2026-06-20 2026 | 5 security best practices for adopting generative AI code assistants like GitHub Copilot beginner 6 min read | Checklist for safely adopting generative AI code assistants like GitHub Copilot and Amazon CodeWhisperer. This guide emphasizes continuous human validation of AI-generated code, integrating security scanning tools within the IDE, and utilizing Software Composition Analysis (SCA) for third-party dependencies. It also highlights the importance of automating security testing and implementing policies to protect intellectual property from being learned by AI models, referencing incidents like Samsung's ChatGPT ban. → snyk.io |
| 2026-06-20 2026 | How Snyk ensures safe adoption of AI beginner 7 min read | Library that uses DeepCode AI, a hybrid approach combining symbolic and machine learning AI, to secure AI-generated code. This technology analyzes code in real-time within the IDE, identifying vulnerabilities like those introduced by tools such as Copilot. It provides accurate results with reduced false positives by incorporating multi-file, interfile, and dataflow analysis, and offers AI-generated fix candidates that are validated for security before recommendation, mitigating risks of license infringement, IP violations, and software vulnerabilities. → snyk.io |
| 2026-06-20 2026 | Introducing Snyk’s partnership with Gemini Code Assist beginner 3 min read | Library integrating Snyk's security expertise with Google Gemini's AI coding assistance. This partnership delivers automated fixes and in-line security feedback for AI-generated code within IDEs like Google Cloud Code, providing full application context to identify vulnerabilities early. It leverages DeepCode AI for SAST and aims to accelerate development velocity without compromising security, allowing teams to adopt AI coding assistants confidently. → snyk.io |
| 2026-06-20 2026 | How SAS secures their AI-generated code beginner 8 min read | Talk from Snyk, moderated by Clinton Herget and featuring Brett Smith and Chris Knackstedt, addresses the security challenges of AI-generated code. The session explores risks such as code quality issues stemming from diverse training data, new attack vectors like prompt injection and library squatting, and AI hallucinations. It emphasizes the importance of developer education regarding AI tool limitations and IP protection, alongside reinforcing traditional security measures like static code analysis (SAST) with tools like Snyk Code to combat the increased velocity of vulnerable code injection. → snyk.io |
| 2026-06-20 2026 | An investigation into code injection vulnerabilities caused by generative AI intermediate 4 min read | Analysis of 4000+ Python repositories reveals code injection vulnerabilities (CWE-94) stemming from generative AI's large language models (LLMs). Issues arise from treating LLM output as trusted, particularly when user input influences prompts (prompt injection) and when LLM responses are passed to insecure functions like Python's `eval()` for parsing expected JSON. This can lead to arbitrary code execution. Recommendations include replacing `eval()` with `json.loads()` and rigorously validating LLM-generated code before execution, ideally within sandboxed environments. → snyk.io |
| 2026-06-19 2026 | Agentic Security Threats: Prompt Injection Becomes Live Malware beginner 4 min read | Library for detecting and mitigating agentic security threats, specifically focusing on LLM prompt injection. It details the evolution of promptware into live malware, citing examples like IDPI, Check Point's Skynet sample, EchoLeak (CVE-2025-32711), and ESET's PromptLock. The resource outlines the seven-stage promptware kill chain, highlighting tactics such as indirect injection, runtime abuse, and package compromise. It also covers defensive measures including retrieval boundaries, architectural separation, adversarial training, and enhanced monitoring, along with skill development pathways like the AI Ethical Hacker™ certification. |
| 2026-06-19 2026 | Wiz Research Finds Critical NVIDIA AI Vulnerability Affecting Containers Using NVIDIA GPUs, Including Over 35% of Cloud Environments news 7 min read | Library detailing CVE-2024-0132, a critical container-escape vulnerability in the NVIDIA Container Toolkit that allows attackers to gain full host system access. This affects AI applications using GPUs within containers and is particularly concerning for shared compute environments like Kubernetes. Organizations are advised to update the NVIDIA Container Toolkit to version 1.16.2 and the NVIDIA GPU Operator to version 24.6.2 to mitigate this risk. → wiz.io |
| 2026-06-19 2026 | Tricks and Treats: Top 3 GenAI Security Best Practices for a Safer Halloween beginner 2 min read | Analysis of GenAI security risks including data poisoning, model theft, and adversarial attacks. Best practices focus on eliminating shadow AI through an AI Bill of Materials (AI-BOM), safeguarding sensitive data with encryption and DLP policies, and establishing a swift incident response plan. This addresses supply chain attacks in libraries like lottie-player and enhances cloud-native security for serverless containers. → wiz.io |
| 2026-06-19 2026 | Introducing the next generation of AI-powered remediation: Choose your own remediation strategy intermediate 5 min read | Library that uses GenAI and Wiz Research's expertise to generate granular, contextual remediation guidance for cloud security issues, including "toxic combinations." It allows users to select remediation strategies based on risk, cloud context, and business needs, breaking down complex issues into actionable steps. The system accounts for various risk factors like misconfigurations, vulnerabilities, and external exposure, offering tailored advice for patching vulnerabilities, scoping access, removing exposure, and reducing permissions. → wiz.io |
| 2026-06-19 2026 | Introducing new Amazon Q Developer plugin for Wiz intermediate 4 min read | Library extends Amazon Q Developer with a Wiz plugin, bringing Wiz's Cloud-Native Application Protection Platform (CNAPP) capabilities directly into the AWS console. This integration allows AWS developers to query their cloud security posture using natural language, gaining immediate insights into risks such as critical attack paths and the riskiest assets. By democratizing security and reducing operational overhead, the plugin empowers developers to uphold security best practices and prioritize remediation efforts effectively without leaving their familiar AWS environment. → wiz.io |
| 2026-06-19 2026 | The President’s Executive Actions on AI Have a Lot to Say on Cybersecurity news 10 min read | Analysis of the President's Executive Order on AI and NSPM-11, highlighting shifts from static compliance to risk-based vulnerability prioritization. CISA's BOD 26-04 mandates rapid remediation of actively exploited vulnerabilities, replacing older directives like BOD 22-01 and BOD 19–02. This framework emphasizes context-driven assessment and AI-enabled defensive tools for faster detection, investigation, and remediation, influencing federal contracts and private sector partnerships. → wiz.io |
| 2026-06-19 2026 | DevOpsDays Singapore 2024: Unmasking the security pitfalls in AI-generated code intermediate 2 min read | Talk from DevOpsDays Singapore 2024 highlights security challenges in AI-generated code. Tools like Copilot, AWS Code Whisperer, and Gemini can increase development speed but may introduce vulnerabilities such as SQL injection and XSS, or use outdated libraries. An analysis showed 40% of Copilot-generated code had flaws. Live demonstrations illustrated how AI can both introduce and help fix these security issues with proper prompting. Security tools like Snyk, integrating into development environments, are crucial for scanning and remediating these vulnerabilities early in the SDLC. → snyk.io |
| 2026-06-19 2026 | More accurate than GPT-4: How Snyk’s CodeReduce improved the performance of other LLMs advanced 5 min read | Library that enhances LLM performance for security vulnerability autofixing. It employs proprietary CodeReduce technology, which utilizes program analysis to narrow the LLM's attention to critical code snippets, significantly improving fix generation accuracy and speed. This approach addresses LLM limitations by focusing on curated security fix datasets and contextual code, outperforming existing models like GPT-4 on various vulnerability types including AST, Local, FileWide, SecurityLocal, and SecurityFlow issues. → snyk.io |
| 2026-06-19 2026 | 5 tips for adopting AI code assistance securely beginner 4 min read | Library of security tips for adopting AI code assistants like GitHub Copilot and Amazon CodeWhisperer. It emphasizes integrating human oversight, using separate security tools for scanning AI code, validating third-party dependencies with Software Composition Analysis (SCA), automating security testing within development workflows, and protecting intellectual property by carefully managing AI prompts to prevent data leakage. → snyk.io |
| 2026-06-19 2026 | Secure AI tool adoption: Perceptions and realities beginner 3 min read | Survey of 459 IT professionals globally, including AppSec, developers, and C-suite, reveals that while organizations feel ready for generative AI coding tools, less than 20% conduct formal POCs. Security fears are the biggest adoption barrier, yet AppSec teams express greater concern about AI code security and insufficient policies compared to management. The report highlights a discrepancy in AI readiness perceptions across roles, with leadership being more optimistic than those directly involved with code. → snyk.io |
| 2026-06-19 2026 | The full Snyk AI Security Platform, free for open source maintainers news 3 min read Secrets | Platform offering open source maintainers free access to the Snyk AI Security Platform. It focuses on issue prioritization using exploitability, reachability, and asset criticality, alongside automated fix pull requests for vulnerable dependencies via the Snyk Remediation Agent, which uses frontier-model reasoning for validated, merge-ready fixes in Snyk Open Source and Snyk Code. → snyk.io |
| 2026-06-19 2026 | [tl;dr sec] #333 - Perplexity's Bumblebee, Evading Cloud Logging, AI Vuln Hunting Spec intermediate 12 min read | Library for detecting malware in packages, agent configurations, and browser extensions, alongside techniques for evading cloud logging, and a specification for building custom AI security scanning systems. It details how formal methods are becoming more practical for AI-generated code, and how Microsoft's Agentic Secret Finder reduced false positives in GitHub's AI secret scanning by 75% through context extraction. The entry also covers the discovery of HTTP/2 Bomb, a DoS vulnerability affecting multiple web servers, and methods for disrupting AWS CloudTrail logging and abusing cloud logging services for defense evasion and visibility. → tldrsec.com |
| 2026-06-19 2026 | Aikido and OWASP bring agentic Code Audit to the global AppSec community news 4 min read | Library offering agentic Code Audit powered by AI reasoning, allowing OWASP individual members 200 free credits for pentester-grade analysis. This new class of static analysis reasons about code intent to find complex vulnerabilities like insecure direct object references (IDORs), broken access controls, multi-step exploit chains, business logic flaws, authentication bypasses, and privilege escalation, going beyond traditional SAST pattern matching. It supports various languages, configurations, infrastructure-as-code, and diverse repository structures like monorepos and mobile apps. → owasp.org |
| 2026-06-18 2026 | New Developments in LLM Hijacking Activity advanced 3 min read AuthZ | Writeup detailing the JINX-2401 LLM hijacking campaign targeting AWS environments. The campaign involves using compromised IAM credentials to invoke Bedrock models, employing privilege escalation and persistence techniques. Wiz Research identified specific IAM username and policy naming patterns, alongside failed attempts to create and access LLM models, ultimately blocked by SCPs. This analysis also touches on broader LLM abuse trends and detection strategies within AWS. → wiz.io |
| 2026-06-18 2026 | Introducing the Red Agent POV Series beginner 5 min read | Tool demonstrating an AI-powered pentester, the Red Agent, which autonomously discovers logic-driven vulnerabilities and multi-step attack chains at machine speed. It reasons about application behavior, learns from failed probes, and synthesizes complex attack paths to uncover issues like broken access control, leaked secrets, RCE, SQL injection, PII/PHI exposure, and JWT `alg:none` bypasses, as detailed in its first blog post on SSRF exploitation. → wiz.io |
| 2026-06-18 2026 | 4 AI coding risks and how to address them beginner 5 min read | Library for addressing AI coding risks; highlights include injection vulnerabilities, authentication weaknesses, and misconfigured permissions. It emphasizes the need for human oversight and offers strategies like SAST with tools like Snyk Code, conducting audits, and developing clear organizational policies to mitigate issues related to AI-generated code, intellectual property infringement, and lack of explainability. → snyk.io |
| 2026-06-18 2026 | Snyk Code now secures AI builds with support for LLM sources news 2 min read Secrets | Library updates for Snyk Code now secure AI builds by tracking data flows from LLM libraries, including those from OpenAI, HuggingFace, Anthropic, and Google. This enhancement performs taint analysis on data returned from LLM sources, treating it as untrusted by default, to detect vulnerabilities such as prompt injections, SQL injection, and XSS. The tool identifies unsanitized data sinking into sensitive functions or data stores, alerting users to potential security issues even in projects with initially unsupported LLM frameworks. → snyk.io |
| 2026-06-18 2026 | Infosec Europe session: 4 tips for safer AI adoption beginner 5 min read | Reference from Infosecurity Europe 2024 outlines four tips for safer AI adoption in businesses. Key strategies include classifying AI usage by business impact criticality, not solely relying on LLMs for security but implementing AI guardrails like code reviews and peer validation, with tools like Snyk Code offering AI-fast SAST scans. It also emphasizes understanding and protecting AI training models from attacks such as prompt injection, and inventorying AI's presence within the existing tech stack. → snyk.io |
| 2026-06-18 2026 | A security expert’s view on Gartner’s generative AI insights - Part 2 beginner 5 min read | Library for AI-driven application security, Snyk Agent Fix integrates into IDEs for real-time autofixing, leveraging a specialized, proprietary LLM trained on security data rather than general code functionality. This approach ensures more reliable security fixes than those from general-purpose LLMs. The library aims for accuracy and speed, catering to both developer and security teams, and includes features like SBOM generation and proactive risk neutralization, as demonstrated by its early discovery of the Leaky Vessels zero-day vulnerability. → snyk.io |
| 2026-06-17 2026 | Dive into AI and LLM learning with the new Snyk Learn learning path beginner 1 min read | Library provides a free learning path on Snyk Learn, focusing on the OWASP Top 10 for LLMs and GenAI. This path addresses critical security challenges in AI systems, including prompt injection and sensitive information disclosure, equipping developers and security professionals with knowledge to secure AI-driven applications. → snyk.io |
| 2026-06-17 2026 | The Intelligent Shield. OpenCTI intermediate | "The Intelligent Shield" proposes an AI-driven enrichment approach for OpenCTI, moving beyond manual threat intelligence. It addresses data fragmentation and lack of context in cyber attacks by utilizing automated machine learning pipelines. This system aims to transform raw threat data into high-confidence intelligence, enabling security teams to effectively manage the overwhelming volume of information and respond to sophisticated threats. → infosecwriteups.com |
| 2026-06-17 2026 | Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE intermediate 12 min read RCE Supply Chain | Library for hijacking Vertex AI model uploads, exploiting predictable default bucket names and missing ownership checks in the Python SDK (versions 1.139.0 and 1.140.0). This "Pickle in the Middle" attack enables cross-tenant RCE by allowing an attacker to squat on a victim's staging bucket and replace legitimate model artifacts with malicious ones, leveraging pickle deserialization to execute arbitrary code upon deployment. → unit42.paloaltonetworks.com |
| 2026-06-16 2026 | Prompt injection protection: Detecting and blocking malicious AI instructions intermediate 9 min read | Reference detailing prompt injection, a critical security risk for LLM-powered applications ranked first on the OWASP LLM Application Top 10 for 2025. It differentiates between direct and indirect prompt injection, highlighting how malicious instructions can be hidden within everyday content like documents or emails, posing a significant threat when AI systems can access sensitive data and execute actions. Real-world examples like EchoLeak and Reprompt illustrate data exfiltration via prompt injection in tools like Microsoft 365 Copilot, while research into AI agents by Trail of Bits shows potential for remote code execution. |
| 2026-06-16 2026 | What we found instrumenting AI coding agents in production for two weeks (post-mortem) intermediate 3 min read | Control plane for instrumenting AI coding agents, Aten Security's Thoth runtime, addresses the gap in traditional logging by providing immediate contextual attribution for agent actions, mapping them to user sessions, tool schemas, and execution states. Phase 2 of a 14-day pilot demonstrated frictionless interception staging, allowing programmatic flagging of out-of-scope or high-risk actions through simulated MFA parameters without breaking agent execution. Updates to Thoth now automate agent wrapping and triage path registration, minimizing the developer integration tax required for effective AI governance. |
| 2026-06-16 2026 | SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon advanced 7 min read | Library detailing SearchLeak, a three-stage vulnerability chain for Microsoft 365 Copilot Enterprise. This chain exploits Parameter-to-Prompt Injection, an HTML rendering race condition, and a Content Security Policy bypass via Bing SSRF. The technique allows silent data exfiltration of emails, calendar entries, and documents by tricking Copilot into generating an image tag with stolen data embedded in the URL, which is then processed by Bing. Microsoft has remediated this under CVE-2026-42824. |
| 2026-06-16 2026 | Research Briefing: MCP Security beginner 9 min read | Library for securing Model Context Protocol (MCP) integrations, detailing supply chain risks from unvetted GitHub repositories, typosquatting, impersonation, and account takeovers in registries. It addresses local server vulnerabilities like arbitrary code execution and remote server risks including RCE, credential theft, and data leakage. The library also covers MCP client security, highlighting issues with auto-run features, tool name conflicts, slash command hijacking, and indirect prompt injection, offering guidance for early adopters to mitigate these evolving threats. → wiz.io |
| 2026-06-16 2026 | Introducing the MCP Server for Wiz: Smarter AI Context, Stronger Cloud Security beginner 3 min read | Reference on the Wiz Model Context Protocol (MCP) Server, an AI integration standard used to unify security data, enhance cloud visibility, and provide contextual intelligence for security investigations. The MCP Server facilitates natural language queries for risk assessment, inventory discovery, and remediation workflows, including integration with IDEs for instant vulnerability fixes and Wiz Defend for threat containment. The entry also highlights potential security risks associated with MCP data handling. → wiz.io |
| 2026-06-16 2026 | Foundations of trust: Securing the future of AI-generated code beginner 4 min read | Program that partners with AI coding assistants like Codieum, Tabnine, TabbyML, and Qodo to integrate Snyk's security capabilities. This initiative addresses vulnerabilities common in AI-generated code, such as inaccuracies, hallucinations, security flaws, data poisoning, and prompt injections. By embedding real-time SAST guardrails and automated remediation through DeepCode AI Fix into IDE extensions, the program aims to secure AI-assisted development workflows and increase trust in AI-generated software. → snyk.io |
| 2026-06-16 2026 | Automatically fix code vulnerabilities with AI intermediate 4 min read XSS | Library for automatically fixing common security vulnerabilities, such as Cross-site Scripting (XSS) in Java Spring Boot applications. It leverages a hybrid AI model combining generative AI, symbolic AI, and machine learning, trained on curated data from Snyk's security research team, to provide AI-driven code fixes directly within IDEs. This capability complements existing remediation advice and differs from pure generative AI tools like Copilot by incorporating a security-first approach. → snyk.io |
| 2026-06-16 2026 | Find, auto-fix, and prioritize intelligently, with Snyk's AI-powered code security tools intermediate 9 min read | Library for AI-powered application security, Snyk Code, offers automated detection and remediation of vulnerabilities. Utilizing DeepCode AI, it scans code directly within the IDE, providing rapid SAST analysis and auto-fixing suggestions via its Snyk AgentFix feature. This multi-model AI approach combines different methodologies for enhanced reliability, ensuring suggested fixes are screened by symbolic AI before developer application, reducing mean-time-to-remediate and improving code security for AI-generated code. → snyk.io |
| 2026-06-16 2026 | Gitguardian Agent Skills: Secret Detection and Remediation For AI-Assisted Development beginner 9 min read Secrets | Library of GitGuardian Agent Skills enabling AI coding assistants to perform secret detection and remediation. These skills translate developer concerns into concrete actions, guiding AI agents to utilize `ggshield` for scanning repositories, local machines, and Git history for secrets. Supported slash commands include `/gitguardian:scan-secrets` for various scan types, `/gitguardian:create-honeytokens` for decoy credentials, `/gitguardian:scan-machine` for comprehensive local audits, `/gitguardian:check-hmsl` for checking leaked secrets without exposing them, and `/gitguardian:install-git-hooks` to integrate `ggshield` as pre-commit or pre-push hooks. → blog.gitguardian.com |
| 2026-06-15 2026 | Rules Files for Safer Vibe Coding beginner 4 min read | Library for crafting secure AI-generated code. This resource outlines the creation of "rules files," a pattern to provide standard security guidance to AI coding assistants. It details best practices for rules file construction, common vulnerabilities in AI-generated code such as CWE-94 (Code Injection) and CWE-306 (Missing Authentication), and research-based prompting techniques to reduce risk. The project open-sources baseline rules files for popular languages and frameworks like Python (Flask, Django), Javascript (React, Node.js), Java (Spring), and .NET (ASP.NET Core), compatible with tools such as Cursor, Cline, Claude, Windsurf, Codex, Aider, and GitHub Copilot. → wiz.io |
| 2026-06-15 2026 | Lean and Mean: How We Fine-Tuned a Small Language Model for Secret Detection in Code intermediate 9 min read | Library fine-tuning LLAMA-3.2-1B achieves 86% precision and 82% recall for secret detection in code, outperforming regex-based methods. This lean model offers a cost-effective, privacy-preserving alternative to large language models for enterprise-scale scanning. The process involved multi-agent data labeling with models like Sonnet, strategic data filtration, and Low-Rank Adaptation (LoRA) for efficient fine-tuning. → wiz.io |
| 2026-06-15 2026 | AI Is Everywhere—But Security Teams Are Still Catching Up news 2 min read | Report on AI security readiness surveying 96 organizations, finding 87% use AI services from platforms like OpenAI and Amazon Bedrock, yet 31% cite a lack of AI security expertise as their top challenge. Most rely on traditional controls such as secure development processes and tenant isolation, with only 13% utilizing AI-specific security posture management. This lack of AI-specific protections and visibility, especially in multi-cloud environments, exposes organizations to risks like sensitive data exposure and misconfigurations, with 25% unaware of all AI services in their environment. → wiz.io |