Generative AI Security: Are Your Developers Pasting Secrets Into LLMs?
This is the fifth post in our "Bring Your Own Source" series. The previous ones covered n8n workflow integration, Salesforce, GitLab CI, and GitHub Gists.
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Treat Your AI Agents Like Humans or You Are Creating Risk
AI agents are about to act as humans inside your organization. Curtis Koenig, Head of Application Security at Gen, explains why treating them with the same identity and data controls is the single most important step to get ahead of AI risk. "We're going to give these agents the capability to do things as though they were humans. If we are not treating them like we treat our other human users in our organizations, that's where we're creating risk.".
Why Open Source Is the Easiest Target for Supply Chain Attacks
Attackers targeting open source dependencies already have all the code they need. Curtis Koenig, Head of Application Security at Gen, explains the fundamental asymmetry and why building quality fixes at speed is the real challenge for defenders. "An attacker can produce very fast, very ugly code that propagates through as an attack. When we're trying to fix something, the challenge we have is we're always trying to build for quality.".
If AI Can Build the Exploit, It Can Write the Patch
The window between an exploit being discovered and actively used is around eight hours. Curtis Koenig, Head of Application Security at Gen, explains why zero trust and a prepared incident response process remain the foundation for security teams navigating this new threat landscape. "The good news is that if the tool can find a vulnerability and create an exploit, it can find a vulnerability and write a patch as well.".
Detect, Remediate, and Prevent Credential Layer Secrets Sprawl | GitGuardian Overview
Your security stack does its job. But credentials move between your tools: into pipelines, container images, Slack threads, Jira tickets, and local machines. Together they form a credential layer that no single tool was built to see. GitGuardian is the Credential Layer Security platform that helps teams detect, remediate, and prevent secrets sprawl. In this overview, you'll see how GitGuardian: Trusted by 600K+ developers and the most-installed security app on the GitHub Marketplace.
AI Coding Agents Are Leaking Credentials: Cursor, Claude Code, Copilot, and MCP
Cursor, Claude Code, and GitHub Copilot leave credentials scattered across config files, logs, and shell history that repository and CI scanners never see. Here's where that trail actually lives, and how to close it.
How the GitGuardian Mixin Kit Extends Docker Sandboxes for Safer AI Coding
Docker Sandboxes isolate AI coding agents from the host. The GitGuardian Mixin Kit adds ggshield and AI hooks to scan prompts, tool actions, and outputs for secrets, giving developers a safer, repeatable path for agentic coding.
GitHub App Private Keys: 474 Leaked Keys Exposed
GitGuardian tested thousands of leaked GitHub App private keys and found 474 valid ones, some with admin access to entire organizations. CDC and BuildBuddy were among those affected. See the findings.
What a Supply Chain Attack Is Really After: Your Credentials
Recent campaigns show a consistent pattern: a supply chain attack compromises trusted software to reach the credentials held by developer machines and CI/CD pipelines.
Decibel Partners' Dan Nguyen-Huu on AI agents gaining user admin rights
When AI agents during OpenAI's model training autonomously gained user admin rights on Hugging Face, organized on message boards, and escalated privileges, it signaled a permanent shift in cybersecurity. Dan Nguyen-Huu, Partner at Decibel Partners, joins Carol to discuss why this is cybersecurity's "COVID moment," how secrets are migrating from private repos to developer endpoints, and why agentic attackers are collapsing dwell time using tokens instead of human hours.