Topic
SECURITY
All blog posts, tools, and guides about Security from Developers Digest.
36 resources - 31 posts, 3 tools, 2 guides
Blog Posts
View in blog →
GitLost: How Researchers Tricked GitHub's AI Agent Into Leaking Private Repos
Security researchers discovered a prompt injection vulnerability in GitHub's Agentic Workflows that allows attackers to extract private repository contents through public issues.
7 min read
Flipper Zero Shifts to Community-Driven Development
Flipper Devices announces their firmware hit 1.0 stability and outlines a new community contribution model - while HN debates whether 'done' software is actually a good thing.
5 min read
Claude Code Is Steganographically Marking Requests
A developer reverse-engineered Claude Code and found hidden markers that classify users by timezone, domain, and API keywords - using unicode apostrophe swaps and date format changes.
7 min read
GLM 5.2 Outperforms Claude Code on Semgrep's IDOR Vulnerability Benchmarks
Semgrep's security research team benchmarked LLMs on IDOR vulnerability detection. The open-weight GLM 5.2 beat Claude Code by 7 points at roughly one-sixth the cost.
6 min read
OpenAI's June API Updates Are Really a Control-Plane Upgrade
OpenAI's June 2026 API changelog looks like scattered platform plumbing. Read together, moderation scores, workload identity, Admin APIs, prompt-cache retention, container billing, and Secure MCP Tunnel are the pieces teams need to run agents with real controls.
8 min read
Perplexity Bumblebee: Developer Guide to the Open Source Supply Chain Scanner
Bumblebee is Perplexity's open source scanner for detecting compromised packages, extensions, and MCP configs on developer machines. A read-only Go binary that checks npm, PyPI, Go modules, and 10+ ecosystems against exposure catalogs - without running any install scripts. Here is how to set it up and use it.
7 min read
Arcade AI Agent Authorization: A Developer Guide
Arcade just raised $60M to become the secure action layer for production AI agents. Here is what their MCP runtime actually does, how it differs from rolling your own OAuth, and when to use it.
7 min read
Vulnerability Reports Are Not Special Anymore
Filippo Valsorda argues that LLMs have ended the era of treating security researchers with kid gloves. When anyone can discover vulnerabilities with an AI, the old coordinated disclosure model breaks down.
7 min read
Agent Identity Is the Missing Security Layer for AI Workflows
The Linux Foundation's Agent Name Service proposal points at a real gap in AI agent infrastructure: agents need verifiable identity, scoped capabilities, revocation, and audit trails before they can safely act across tools.
7 min read
Agent Sandbox Architecture: How to Choose the Right Runtime Boundary
AI agents are getting their own computers. Here is how to choose a sandbox architecture: filesystem isolation, network policy, secrets boundaries, snapshots, and when shell access is overkill.
8 min read
Cybersecurity Skills for AI Agents Are Becoming Runtime Infrastructure
A GitHub-trending library of Anthropic cybersecurity skills points at the next agent security layer: framework-mapped playbooks that need provenance, tests, and abuse boundaries before they become trusted runtime tools.
8 min read
OpenAI Daybreak Shows the AppSec Bottleneck Is Patching, Not Finding
OpenAI's Daybreak and Patch the Planet point at the real agentic AppSec shift: security agents only matter when they produce validated, reviewable patches maintainers can actually merge.
8 min read
Claude Code Permissions: A Practical settings.json Guide for Allow, Deny, and Ask Rules
Stop the approval-fatigue prompts without going full YOLO mode. A hands-on guide to Claude Code's permission system - settings.json scopes, allow/deny/ask rules, tool specifiers, and the headless flags that actually matter.
11 min read
Mastra npm Supply Chain Attack: 140+ AI Framework Packages Backdoored
On June 17, 2026, attackers hijacked a dormant Mastra contributor account and pushed malicious versions of 140+ packages. The payload steals crypto wallets, browser data, and cloud credentials. Here is what happened, how to check your lockfile, and what to do if you installed an affected version.
7 min read
AI Infrastructure Agents Need Spend Guardrails
The viral DN42 AWS bill story is funny until you realize the missing primitive: infrastructure agents need hard cloud-spend guardrails before they touch real accounts.
8 min read
The One-Cent Attack: Prompt Injection Through Bank Transfer Memos
Security researchers showed a €0.02 bank transfer could compromise a banking AI assistant. Here is the exact attack chain - and what every developer building agents needs to do differently.
8 min read
Fable 5 Broke Enterprise ZDR Agreements: What Dev Teams Must Do Now
Anthropic's Claude Fable 5 mandates 30-day data retention on every platform, overriding existing Zero Data Retention contracts for enterprise API customers. Here is what compliance teams and developers need to audit before their next deployment.
8 min read
June 10, 2026: The Day the AI Dev Tool Market Showed Its Whole Hand
Pricing deadlines, infrastructure funding, a banking prompt injection case, and a 4x speed breakthrough - June 10 was one of the densest single days the AI dev tool market has ever produced.
7 min read
Agent Config Files Are Executable Supply Chain
A Hacker News thread on config files that run code points at the next AI coding risk: agent hooks, skills, and editor rules need review like executable dependencies.
8 min read
Security Agents Need Repro Harnesses, Not More Scan Prompts
Anthropic's open-source vulnerability harness shows where AI security work is going: reproducible exploit loops, separate verification agents, and patch receipts.
9 min read
The Agent Security Checklist I Use Before Connecting Tools
Before an AI agent gets tools, files, APIs, MCP servers, or deployment access, decide what it can read, write, call, log, and roll back.
8 min read
AI Security Scanners Move the Bottleneck to Triage
Anthropic's Project Glasswing update is a useful signal for developer teams: AI can find vulnerability candidates faster than humans can verify, disclose, patch, and ship them.
8 min read
Sandboxed Agents Are Becoming the Team Control Plane
Runtime's Launch HN thread is a useful signal: teams do not just want isolated coding agents. They want a control plane for approvals, secrets, telemetry, review, and merge policy.
8 min read
Agent Skills Are Becoming Package Managers
GitHub trending is full of agent skill registries. The winning pattern is not more prompts. It is dependency governance for the instructions your coding agents inherit.
8 min read
Claude Code Plugin URLs Turn Skills Into a Supply Chain
Claude Code's newer plugin URL and hard-deny controls are small release-note items with a big implication: agent extensions now need supply-chain discipline.
6 min read
TanStack's npm Compromise Is the CI Lesson Agent Teams Needed
The TanStack npm incident was not just a package-security story. It was a reminder that AI agent workflows inherit every weak trust boundary in CI.
9 min read
OpenAI's Codex Mac Certificate Deadline Is a Runbook Test
OpenAI's May 8 macOS certificate rotation for ChatGPT, Codex, Codex CLI, and Atlas is not just a one-off update. It is a useful test of how your team governs AI developer tools.
7 min read
Approval Fatigue Is an Agent Security Bug
Manual approval prompts stop protecting users when coding agents ask too often. The better pattern is risk-aware autonomy: safe defaults, narrow deny rules, and approvals only for meaningful changes.
7 min read
lib0xc Is the Opposite of Rewrite Culture
Microsoft's lib0xc landed on Hacker News with a practical message: safer systems code often means better C APIs, warnings, bounds checks, and incremental adoption, not a heroic rewrite.
8 min read
Codex Security Preview: AppSec Agent for Real Repos
OpenAI's Codex Security agent reviews app code for vulns. Here is what it caught and missed on three real production repos.
10 min read
OpenAI Codex Cloud Security Playbook 2026: Internet Access, Prompt Injection, and Safe Defaults
A practical security playbook for running Codex cloud tasks safely in 2026 using OpenAI docs: internet access controls, domain allowlists, HTTP method limits, and review workflows.
10 min read
Related Tools
All tools →Cloudflare
This SiteCDN, DNS, DDoS protection, and edge computing. Free tier handles most needs. This site uses Cloudflare for DNS and analytics. Workers for edge compute.
InfrastructureGlama
Largest MCP server directory with 17,000+ servers. Security grading (A/B/C/F), compatibility scoring, and install configs. ChatGPT-like UI for browsing and testing.
MCP ToolsE2B
Open sourceOpen-source cloud sandboxes for AI agents. Isolated environments that start in under 200ms, run code in Python, JavaScript, and more, and persist sessions up to 24 hours.
InfrastructureGuides
All guides →Claude Code Complete Course
A complete, citation-backed Claude Code course with setup, prompting systems, MCP, CI, security, cost controls, and capstone workflows.
GuideChronicle Research Preview Setup Guide
Set up Codex Chronicle on macOS, manage permissions, and understand privacy, security, and troubleshooting.
GuideKeep exploring
More on Security
- - Cloudflare - recommended Security tool from the Developers Digest directory
- - Tools Directory - dive deeper across the Developers Digest knowledge base
- - All Security articles in the blog archive
- - Developers Digest on YouTube - video tutorials covering Security and more
Get Smarter About AI Dev
New tutorials, open-source projects, and deep dives on coding agents - delivered weekly.
One email per weekReal code, not theoryFree forever
Explore 688 topics
Browse All Topics