Amazon Q vulnerability could allow attackers to steal developer cloud credentials by luring them into opening a booby-trapped ...

CVE-2026-12957 in Amazon Q is the third MCP auto-execution vulnerability in three AI coding tools. The pattern reveals a ...

Overview Windsurf and Amazon Q Developer, two familiar AI coding brands, will have each moved into different product areas by ...

Hackers created a fake trading bot for Polymarket’s prediction markets on GitHub. The bot was used to spread malware that ...

JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.

GitHub secret scanning now extends beyond org-owned repositories: Public Monitoring scans all of GitHub.com in real time, ...

Decades-old Bash shell tricks can bypass safeguards in most open source AI coding agents, creating a new software supply ...

AI compressed the build. Fundamentals matter more, not less, and the product funnel is now where engineers earn their keep.

Mozilla 0DIN’s Claude Code demo shows how clean GitHub repos can expose AI coding agents to prompt injection, reverse shells, ...

Qodo, the AI code quality and governance platform trusted by Walmart, NVIDIA, Red Hat, and Monday.com, today announced three new platform capabilities: Cross-Repo Code Review, Custom Rules Miner, and ...

The new “agentjacking” attack takes almost no real hacking ability to pull off. It's predicated on pulling a public ...

A LayerX security study found that six AI browser agents could be tricked into exposing credentials from logged-in accounts, highlighting how prompt injection remains one of the biggest risks facing ...