Sysdig AI Defense adds runtime guardrails for AI agents
It can allow, hold, or block an agent action before it finishes and keeps a kernel record the agent cannot change.
Stories per day · 30 days
2 RSS
Relatedai-agents3hack-the-box2mcp2secrets2ai-security1application-security1appsec1bearer-cli1chatgpt1code-security1credential-exposure1devguard1flowise1framework1gdpr1identity1llm-agents1nist-csf1
31 stories, newest first · one card per story
Stories tagged #owasp
Three-Tier Framework Maps MCP Vulnerabilities
MCP's blended data/control planes create unmitigable prompt injection and confused deputy issues beyond server fixes.
OWASP co-leads release free RAID-AI ransomware assessment
Users manually rate controls from zero to five; RAID-AI does not connect to systems or verify the answers.
1
OWASP: ChatGPT guided a low-skill tester to an admin takeover
On Hack The Box machine Silentium, ChatGPT steered nmap and curl use against a vulnerable Flowise site; autonomous agents did not finish the takeover.
OWASP finds AI agents lower the skill bar for parts of hacking
Guide 2.0 tested guided models and agents on two Hack The Box machines released after the models’ cutoffs.
Datadog primer explains code security for new and vibe coders
The post contrasts first-party fixes with third-party upgrades and warns agents often pull outdated dependencies.
DevGuard open-source platform ranks and tracks supply-chain findings
One CLI wraps six scan types, and a registry proxy can block known-malicious npm, Go, and Python packages before download.
Roundtable urges closing SDLC identity gaps before expanding AI
Participants say AI-written and non-developer code is outpacing how security is built into development.
1
Bearer CLI scans source code and ranks flaws by sensitive data
The free Elastic License 2.0 SAST tool covers seven languages and can emit a privacy report for GDPR records.
2
AI Agent Workflows Could Expose Credentials Through Trusted Developer Tools
Trellix warns AI agent workflows can leak credentials from vaults into commands, logs, and model context.
6
New Agentic AI Red Team Checklist Adds 222 Tests Across 20 Attack Categories
Researcher Ravi Rajput released 222 agentic-AI red-team tests across 20 categories, mapped to OWASP and MITRE ATLAS.
5
A Security Meta-Model for Retrieval-Augmented Generation Systems
A RAG security meta-model catalogs attacks, weaknesses, risks, and CIA impact drawn from 43 papers.
Top 10 Best API Security Tools in 2026 [Ranked & Scored]
Salt Security tops a 2026 API security ranking, ahead of Traceable and Akamai’s Noname.
9
Vijil DART tests AI agents for security flaws and policy violations
Vijil launched DART, automated adaptive red-teaming that probes enterprise AI agents with multi-turn attacks to find security flaws and policy violations.
How to mitigate the risk from AI-generated apps built by your 'citizen coder' employees
Tenable outlines governance controls to reduce risk from employee-built AI workplace apps.
Top 10 Best Fine-Grained Authorization Tools in 2026 [Ranked & Scored]
A 2026 ranking puts Auth0 FGA, SpiceDB, and Permit.io atop fine-grained authorization tools.
9
Containing the Autonomous Operator: A Defense-in-Depth Framework and Reference Architecture for Securing AI Agents on Kubernetes
Framework secures LLM agents on Kubernetes assuming full prompt-injection compromise, mapping seven defense layers to EKS, AKS, and GKE controls.
Enterprises Struggle to Prepare for AI and Quantum Threats, PwC Says
PwC survey finds most enterprises unprepared for AI attacks and quantum decryption threats.
ModSecurity Vulnerabilities Let Attackers Bypass Web Application Firewall Protections
New ModSecurity flaws let attackers bypass WAF rules via parsing mismatches, bad Base64 handling, and comment obfuscation.
1
Multiple ModSecurity Vulnerabilities Let Attackers Bypass WAF Rules and Execute Malicious Requests
ModSecurity flaws let attackers bypass WAF filename, transformation, and response-body checks.
2
OWASP Noir: Open-source static analysis tool
OWASP Noir statically inventories API endpoints across 29 languages and 205 frameworks, surfacing shadow APIs and hardcoded secrets for reviewers and DAST tools.
If you do one security check this quarter, make it agent memory
Vectorize CEO Chris Latimer says coding-agent memory keeps API keys in plaintext and can be poisoned via plugins and MCP.
1
How AI Agents Can Trigger Runaway Costs for Enterprises
Dark Reading warns unbounded AI-agent consumption, sixth on OWASP's LLM Top 10, can drive runaway enterprise costs.
Siemba brings continuous IDOR testing to production APIs
Siemba released automated IDOR/BOLA testing for REST, GraphQL and SOAP APIs, checking a 200-endpoint collection in under an hour.
2