MITRE ATT&CK v20 adds prompt injection techniques: how to use the new IDs
ATT&CK v20 gives direct and indirect prompt injection, AI-enabled exfiltration and two related behaviours their own IDs. What changed, and the gaps to plan for.
6 min read
Blog tag
#Security
Threats, controls and secure design for AI tools and the systems they touch.
What an agent approval actually approves: effect binding and trusted cards
A new preprint audits ten agent runtimes and finds approvals that don't bind to what executes. The findings, the proposed fix, and what to ask of your tools.
An MCP server entry is a command: three October flaws and headless runs
Junie CLI, ZCode and the Claude Agent SDK all had paths from untrusted input to an MCP server launch. What they share, and where trust prompts disappear.
6 min read
Stateless MCP in production: running old and new protocol versions side by side
Azure MCP Server 3.0 and Red Hat's MCP gateway now speak the 2026-07-28 protocol. What their releases show about version negotiation, lost features and audit.
Roo Code's five unpatched approval bypasses: retiring an abandoned AI extension
Five high-severity CVEs let injected prompts slip denied commands past Roo Code's auto-approve. No fix will ship. How to find and remove dead AI tools.
Poisoned rule files can make coding agents import the wrong package
Researchers hid instructions in AGENTS.md-style rule files and got coding agents to swap real dependencies for attacker packages. What it means for teams.
Infostealers now collect AI coding assistant credentials: what to change
Symantec and Elastic found malware taking AI coding tool credentials from developer machines. What was taken, and how to limit the damage.
GitHub's AI Scan and agentic autofix are GA: what they will and won't do
AI Scan adds advisory findings to pull requests; agentic autofix turns alerts into draft fixes. Coverage, limits, billing and how to fit both into review.
5 min read
When a repository's git config runs code: ConfigPoisoning and coding agents
GitLab researchers showed a coding tool running attacker code from a repository's own git filters. Why deny-lists fail, and what to ask of tools that run git.
5 min read
Singapore's handbook for assessing AI coding assistants, and how to use it
CSA Singapore published a security assessment handbook for agentic coding assistants: six attack vectors, 25 tiered controls and a risk method you can reuse.
The tensorlake npm worm: planted agent settings and a revoke-first trap
A poisoned tensorlake release stole developer credentials, planted Claude Code and VS Code settings in repositories, and punished revoking tokens first.
6 min read
MCP Server Cards: what discovery before connection means for operators
SEP-2127 lets remote MCP servers publish a static card that clients find before connecting. What a card holds, what it leaves out, and the rules to set now.
5 min read
Browse by tag
- #Security (54)
- #Agents (40)
- #AI coding tools (37)
- #LLM costs (23)
- #MCP (16)
- #Evaluation (14)
- #Observability (12)
- #Compliance (11)
- #Enterprise (9)
- #Platform engineering (9)
- #Data privacy (8)
- #DevOps (7)
- #Model routing (7)
- #Open-weight models (7)
- #Research (7)
- #Tutorials (6)
- #Code review (4)
- #Developer productivity (4)
- #Guardrails (4)
- #Networking (4)
- #OpenTelemetry (4)
- #Budgets (3)
- #Prompt engineering (3)
- #Self-hosting (3)
- #MCP gateway (2)
- #Release notes (2)
- #Skills (1)
- #Testing (1)