AI Agent Security: Six Controls From Nine Real Incidents
TL;DR Three attack surfaces: An AI agent exposes its host, its identity, and itself. Nine public incidents between May 2025 and July 2026 hit all th…
Architecture
⚑ Report a ProblemLatest Architecture news from Tech News
All topics
agents
ai
api
architecture
automation
aws
backend
beginners
career
database
devchallenge
devops
javascript
llm
machinelearning
mcp
news
opensource
performance
productivity
programming
python
react
security
showdev
softwareengineering
systemdesign
tutorial
typescript
webdev
AI Hooks for Claude Code, Cursor, and Codex: Block Secrets Before Agents Can Use Them
TL;DR Instructions are suggestions, not controls : Prompts, AGENTS.md, and CLAUDE.md files only guide an agent, which can reinterpret or route aroun…
GSC: A Self-Learning SAST That Proves Vulnerabilities, Fixes Them, and Learns From Your Feedback
TL;DR — GSC (Git Security Checker) is a self-learning AppSec platform that doesn't stop at detecting a vulnerability. It proves it with a sandboxed…
MITRE ATT&CK для Product Security: как связать pentest, threat modeling, CI/CD и реальные сценарии атак
Матрицу MITRE ATT&CK обычно ассоциируют с SOC, threat hunting и red team. Это база. Но она может быть полезна намного раньше — на этапе threat m…
DevSecOps Automation II: A Deep Dive into DAST
In the first part of this series , we looked at Static Application Security Testing (SAST) — scanning source code without executing the application;…
AI Agents vs Traditional Automation: What's Actually Different for Security
The real security difference between an AI agent and traditional automation is not "smart vs dumb". It is where control over execution lives : in co…
Harden & Lockdown RKE2 Cluster with a 4-Layer DevSecOps Stack
Introduction Before you move furniture into a new house, you install the locks, the cameras, and the gates. Kubernetes is no different, yet engineer…
Building a "Fail-Closed" Zero-Trust CI/CD Protocol: A Personal Open-Source Experiment
Hello, Dev community! 👋 I am Anjo Machina (安城巻那), a QA engineer based in Japan. I want to share an open-source project I have been building. It is a…
Beyond free-roaming Agents: Architecting a Deterministic 4-node Graph pipeline for zero-false-positive Autonomous VAPT
Beyond Free-Roaming Agents: Architecting a Deterministic 4-Node Graph Pipeline for Zero-False-Positive Autonomous VAPT Every AppSec engineer eventua…
Building a Read-Only Cloudflare Worker AI Security Console
Why build this Security teams already have WAF events, bot signals, access logs, and SIEM pipelines. The problem is not always data collection. The…
Where the LLM Stops: Deterministic Scoring in an AI-Assisted VAPT Pipeline
Every VAPT report ends the same way: a handful of numbers. A CVSS score. A severity label. A priority rank. Sometimes an aggregate risk score. Those…
Can Copilot Fix Its Own Security Findings? Testing GitHub Agentic Autofix
Can Copilot Fix Its Own Security Findings? Testing GitHub Agentic Autofix GitHub can now assign a code scanning alert directly to Copilot cloud agen…
Proof-of-Fix in GSC: An Architecture for Provable Vulnerability Remediation Verification
Abstract GSC is a self-learning AppSec platform implementing the full pipeline detect → prove → fix → verify → heal → predict . Its defining feature…
Confronting Vault Sprawl And The Risks It Brings
Modern enterprises do not set out to create a maze of credentials, keys, and secrets stores. However, this is the reality most organizations find th…
Never Let the Model Pick the Tenant ID: Securing an LLM Agent in Go
TL;DR : an LLM that calls tools is a client you cannot trust. And it holds your production credentials. The most important rule fits in one sentence…
Give Your Coding Agent a Deterministic Vulnerability Oracle
AI agents can write code, run tests, inspect dependencies, and open pull requests. But when they encounter a vulnerable package, their security reas…
I caught a trojan in my MCP marketplace. Here's the 8-layer defense I built.
Two weeks ago, a Windows trojan slipped into my MCP (Model Context Protocol) marketplace. The malware was Trojan:Win64/Lazy.PGPK!MTB , hidden inside…
Falco on Kubernetes: Runtime Security with eBPF
Originally published on DevToolHub . Most Kubernetes security tools scan for misconfigurations — pods running as root, missing network policies, RBA…
Why Every CISO Needs an AIBOM in 2026 — And What Most Vendors Miss
A friend runs security at a mid-size fintech. Last month she got a Slack ping from her GRC lead: the EU AI Act auditor wanted a full inventory of AI…
78% False Negatives: Your AI Security Scanner Is Gaslighting You
False negatives automated scanning tools are the silent killers in your security posture—they're the critical threats that slip past your defenses w…
Best Practices по GitLab CI/CD: от workflow:rules и кеша до OIDC, BuildKit, ревью-окружений и безопасных раннеров
Статья получилась большой: практик много, и каждая из них важна по-своему. Я собрал материал как набор best practices: не все пункты нужны каждому п…
DevSecOps Automation: A Deep Dive into SAST
In the era of Artificial Intelligence as a work buddy, it is imperative that security is enforced as development progresses. It could be tempting to…
DevSecOps Explained: Embedding Security into Every Deployment
Modern software delivery moves at extraordinary speed. Organizations deploy dozens, hundreds, or even thousands of times each day. While this accele…
Why Every CISO Needs an AIBOM in 2026 — And What Vendors Miss
A friend of mine runs security at a mid-sized fintech. About six weeks ago she called me, mildly furious, because her board had asked a question she…
End-to-End GitHub Security Hardening Guide for Organizations
GitHub is not just a source code platform anymore. For most engineering organizations, GitHub is part identity system, part software supply chain, p…
Cloud Security Is Not About the Tools — It Is About the Thinking Behind Them
Most people think cloud security is about tools. Install GuardDuty. Enable Security Hub. Turn on CloudTrail. Done. It is not that simple. Tools with…
AI Security Scanning Tools in 2026: Snyk vs Semgrep vs OX Security — Real False-Positive Rates Tested
AI Security Scanning Tools in 2026: Snyk vs Semgrep vs OX Security — Real False-Positive Rates Tested If you're still manually reviewing security sc…
The real attack surface for AI coding agents is the config file
If you think the security risk of AI coding agents (Claude Code, Cursor, Gemini CLI) is "the model goes rogue and runs a dangerous command," the ser…
Why your vulnerability dashboard is lying to you (and how to fix it)
You open your vulnerability dashboard on a Monday morning and see 47 critical CVEs across 12 assets. By Thursday, your team has patched 11 of the 12…
Building Agentra, An Enterprise AI Engineering Control Plane for Secure Coding Agents
Open source repository: https://github.com/arijeetganguli/agentra PyPI: https://pypi.org/project/agentra/ AI coding agents are becoming part of ever…