All Articles

A sandbox bypass in Cursor's agentic mode lets attackers poison shell environment variables through implicitly trusted built-ins, converting approved commands like git branch or python3 into arbitrary code execution.

Georgia Tech's Vibe Security Radar tracked 35 CVEs in March 2026 alone attributable to AI-generated code, more than all of 2025 combined. The Cloud Security Alliance's research series documents credential sprawl, governance gaps, and a structural security debt building inside the open-source ecosystem.

Six intelligence agencies from five nations jointly warn that frontier AI will transform offensive cyber capabilities within months, urging board-level action on foundational security controls now.

Google's Mandiant M-Trends 2026 report documents the first confirmed AI-generated zero-day exploit blocked in production, adversaries achieving exploitation seven days before patches ship, and industrial-scale LLM use in offensive operations.

Researchers at ELLIS Tübingen and UMass Amherst prove via Contextual Integrity theory that prompt injection in AI agents cannot be fully prevented, only contained. Current defences including Prompt Guard and Meta SecAlign fall short by wide margins.