June 4, 2026
100 enterprise AI agents rated, plus an open source methodology you can use in procurement and security posture tracking.
Read more: AIRQ: AI Risk Quadrant — independent AI agent security rating (opens in new tab)June 4, 2026
100 enterprise AI agents rated, plus an open source methodology you can use in procurement and security posture tracking.
Read more: AIRQ: AI Risk Quadrant — independent AI agent security rating (opens in new tab)June 4, 2026
100 enterprise AI agents rated, plus an open source methodology you can use in procurement and security posture tracking.
Read more: AIRQ: AI Risk Quadrant — independent AI agent security rating (opens in new tab)
195 posts in Article · Browse all posts
October 8, 2026
MCP security in October 2026: an MCP auth bypass in LiteLLM joins CISA's KEV list, Grafana MCP session spoofing, and malicious servers that pass five scanners.
October 4, 2026
49 AI agent security resources from September 2026: Gemini breaching three companies, 2,000 malicious RubyGems packages, and a zero-click Agentforce hijack.
October 2, 2026
October 2026's AI coding agent security roundup: git config hijacks in seven agents, swapped plugin pins, sandbox escapes, and 13,000 leaked screenshots.
September 23, 2026
Ten documented attacks on Claude Code, from the Miasma worm to TrustFall and GhostApproval. Which vulnerabilities got a CVE, and which are still live today.
September 17, 2026
Vibe coding is democratizing software development, but it is also creating a massive shadow AI attack surface. Security teams cannot rely on bans to address this risk, so they need to build "paved roads": accepted ways of using vibe coding inside the organization.
September 14, 2026
An agent harness turns a language model into an agent: loop, tools, context, approvals, sandbox. Nearly every agent vulnerability we have published lives there.
September 9, 2026
September 2026 in GenAI security: OWASP's LLM Top 10 rebuilt on 6,639 real incidents, stolen reasoning traces, and ten flaws in the local inference engine.
September 7, 2026
September 2026 MCP security roundup: the Deadbugz supply chain campaign hides its payload until the third tool call, plus three new MCP server CVEs.
September 4, 2026
37 agentic AI security resources from August 2026: 19 unauthorized agent actions in a government eval, OpenAI's rogue swarm, and memory poisoning filters miss.
September 3, 2026
September 2026's AI coding agent security roundup: vendor default GitHub Actions reaching RCE, GhostJacking through WAF logs, and OWASP's new skill risk list.
August 25, 2026
OWASP's newest Top 10 covers the skill layer: prose files agents load and act on. What all ten risks mean, and the order to fix them.
August 18, 2026
Ten documented zero-click attacks on AI agents in shipped products: what each one broke, which CVEs followed, and the controls that reduce the risk.
