Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

How Far Can Prompt Injection Reach in Agentic Coding Assistants?

The blast radius of a prompt injection against your coding assistant was set weeks ago, by whoever built the dev environment image. Same assistant, same model, same injected sentence: on a laptop it collects every repository, SSH key and cloud login the developer holds; on a provisioned dev box it collects an organization token plus whatever the image left behind; on a CI runner it collects a deployment credential and a network path to production. Three environments, three incidents, one payload.

Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)

Every time Cloudflare opens a new TLS 1.3 connection to an origin server, we have to make a guess: the protocol requires us to commit to a key agreement algorithm in the very first packet we send, before the origin has told us anything about itself or what it can support. If we guess right, the handshake completes in one round trip. Guess wrong, and the origin replies with a HelloRetryRequest, we start over, and the connection costs two round trips.

Jason Haddix: Stop fearing AI pentesting

This post is based on Mackenzie's conversation with Jason Haddix on The Secure Disclosure podcast. Listen to the full episode or watch below. Jason Haddix has topped the Bugcrowd leaderboards, run security as CISO of Ubisoft, and wrote The Bug Hunter's Methodology, the playbook a lot of working pentesters learned from, so his read on the direction of the field is worth listening to. He believes that “90% of pen tests will be done by AI” in the near future.
Featured Post

Increasingly Dangerous Threats, Not More Alerts, Are the New SOC Challenge

For years, security operations centres have operated under the same constraints of more alerts than analysts, more investigations than hours in the day, and more pressure than most teams can sustainably absorb. That imbalance is becoming dangerous as frontier models rapidly improve at finding vulnerabilities and turning them into exploits, while defenders are left dealing with the consequences in real time.

Sophos To Bring OpenAI GPT Cyber Models Into Managed Risk Offering, Helping Defenders Validate Exploit Paths

The company is building a new Exploit Path Verification (EPV) capability that will tell security teams which vulnerabilities an attacker can reach in their environment, turning long exposure lists into evidence-backed priorities.

Session on AirGapped AI - Adopt AI Privately and Securely, AI Trends from Around the World at CyBe

In this session at CyBe AI Summit 2026, NIMHANS Convention Centre in Bengaluru, our Founder & CEO Mr. Anirban Mukherji discussed current AI trends, geopolitical and sovereignty risks tied to frontier LLMs, and practical implementations for India. He addressed how AI-driven automation like delivery robots and drones can disrupt jobs, why governments and defense agencies require air-gapped or on-prem solutions, and how cost and restricted access to frontier models create inequity in AI adoption.

Securing autonomous AI agents: regulatory risk and governance for modern AppSec

Autonomous AI agents writing and executing code at machine speed present an urgent compliance challenge for modern software organizations. As global regulations tighten, engineering leaders must establish clear governance layers over agentic workflows, external tool calls, and Model Context Protocol integrations to ensure full accountability. In this session, Mend.io experts Asaf Saar and Ben Goldberg unpack the intersection of AI compliance, software supply chain security, and enterprise risk management. Learn how to bridge the accountability gap without sacrificing development velocity.

When the AI Arrives Inside Software You Already Bought

An application that was AI-free at the last audit may be processing corporate data through a language model today. Nobody procured it, nobody approved it and nobody was asked. A vendor shipped a release. ‍ Third-party AI governance is built almost entirely around procurement. Assess the vendor, negotiate terms, sign a data processing agreement, add the tool to a register. The apparatus requires a purchasing event, and an embedded feature produces none, so the apparatus never engages. ‍