Wiz says GhostApproval abuses symlinks so AI coding agents write to SSH keys or shell startup files while showing benign ...

A security vulnerability exists in six major coding agents: via a repository with malicious code, attackers can trick the AI ...

AI Now’s Friendly Fire PoC shows Claude Code and Codex running README-planted payloads on hosts when autonomous command ...

Threat actor 888 claims it stole Accenture source code and cloud credentials, prompting researchers to warn that any exposed ...

Several AI coding assistants were tricked into facilitating developer machine hacking via an attack technique that has been ...

Wiz's 'GhostApproval' uses an old symlink trick to make six AI coding agents, from Amazon Q to Cursor, write outside the sandbox and hand over the box.

This week, hidden breaches, researchers exposed a GitHub AI agent flaw, an Ubiquiti critical flaw, a ColdFusion flaw, a ...

A prompt injection attack can trick GitHub’s preview Agentic Workflows into retrieving content from private repositories and ...

Noma Labs tricked GitHub's AI agent into leaking private repositories with a crafted issue. The prompt-injection flaw, GitLost, has no code fix.

GitGuardian is now live on the Kiro Powers marketplace. Install the Power once, and Kiro's agent scans for exposed secrets ...

A critical prompt injection vulnerability in GitHub Agentic Workflows could allow unauthenticated attackers to leak private repository data, ...