The campaign spans npm, Packagist, Go, and Chrome, using obfuscated JavaScript loaders and VS Code tasks to deliver malware.

GitGuardian is now live on the Kiro Powers marketplace. Install the Power once, and Kiro's agent scans for exposed secrets ...

AI Now’s Friendly Fire PoC shows Claude Code and Codex running README-planted payloads on hosts when autonomous command ...

Lazarus Group concealed a four-module remote access toolkit inside six fake npm Rollup polyfill packages that fired at import ...

Anthropic’s AI coding agent silently encoded proxy hostnames and Chinese timezone data into invisible Unicode characters ...

Former GitHub CEO Thomas Dohmke's startup Entire is rolling out a distributed network for mirroring code repositories, making ...

Noma Labs tricked GitHub's AI agent into leaking private repositories with a crafted issue. The prompt-injection flaw, GitLost, has no code fix.

ActiveState explains how GitHub Actions attack chains can evade traditional CI security scanners, why passing a scan doesn't ...

Researchers warn AI agents could be tricked into downloading malicious code by exploiting hallucinations that cause chatbots ...

SpaceX has agreed to acquire AI coding startup Cursor in a $60 billion stock deal, just a few days after the space company’s historic IPO and less than two months after announcing a tie-up between the ...

AI agents such as OpenClaw are turning developer workstations into always-on edge servers. We test whether the Dell Pro Max ...