How to build a production-grade agentic harness using typed Pydantic tools, a DAG planner with parallel asyncio execution, tiered memory, Planner/Worker/Critic role separation, multi-dimensional budgeting with graceful degradation, and structured tracing for observability.

Cloudflare built a CI-native AI code review system using OpenCode, orchestrating up to 7 specialised agents (security, performance, code quality, etc.) per merge request.

This third installment in Trail of Bits' Nitro Enclaves series catalogs passive and active attack classes against enclave-KMS communication, covering CMK substitution, data key swapping, replay attacks, policy misconfigurations, key commitment gaps, and operational risks.

Researchers chained two memory-safety flaws in Oj, into remote code execution in a Puma worker. The path begins with an attacker-controlled Jupyter notebook and crosses GitLab, ipynbdiff, CRuby, and jemalloc before reaching function-pointer control.

Wiz research examines S3-compatible object storage across neoclouds (Nebius, Vultr, Cloudflare, DigitalOcean, Crusoe, Lambda Labs), covering security risks including public bucket exposure, weak access key patterns, limited least-privilege controls, presigned URLs, encryption gaps, and missing data plane logging.

Monad's security field guide covers logs, blind spots, and detection use cases across 8 AI tools: Claude Code/Cowork OTel, OpenAI Codex OTel, Cursor and GitHub Copilot audit logs, Anthropic Compliance Activity Feed, OpenAI API Platform audit logs, and Google Workspace Gemini activity logs. Each chapter maps what each source records versus what it misses, key fields, and security use cases spanning detection, hunting, IR, and governance.

Sandbox your local AI agents so they can read/write only what they need.

Blacklight is a cross-platform toolkit for mapping, analyzing, and understanding the local AI agent attack surface across Windows, macOS, and Linux. You can also check out the companion blog post.

A GitHub Action for issue triage.

A collection of scripts for assessing Microsoft Azure security.

A PowerShell scanner that combs through MicroBurst Get-AzDomainInfo output for plaintext passwords, keys, connection strings, and other secrets that should never sit unencrypted in an Azure environment.

AWS IAM role manager automates IAM role creation within supported service consoles, eliminating manual role setup. Using managed role templates and a new AcquireRole API, it provisions and attaches least-privilege roles automatically. Roles remain fully customer-controlled and refinable via IAM Access Analyzer.