Grow Therapy built a Claude-powered threat hunting system on ECS Fargate and Lambda, querying Snowflake and Datadog logs across 15 sources. A five-phase AI pipeline (data gathering, baseline comparison, enrichment, confidence scoring, adversarial validation) reduces false positives. Total cost: under $500/month.

Datadog tested Claude Sonnet 5, Composer 2.5, and GPT 5.5 in plan vs. default mode for secure code generation. No meaningful correlation between plan mode and improved security was found; explicit prompt-level security constraints had greater impact than mode selection.

Semgrep benchmarked GLM-5.3 and Grok 4.6 variants on IDOR detection in real open-source code. GLM-5.3 matches Claude Opus 4.8's F1 (~23.7%) at ~1/7th the cost ($0.15 vs $1.04/true positive). Recall remains low across all tested models.

A practical guide to investigating GitHub PAT compromise, based on a real campaign that affected multiple organizations through token abuse.

CloudSEK's research on the LiteLLM supply chain attack, the largest AI supply chain breach of 2026, names the organizations potentially exposed: 2,500+ companies and 434,000 CI/CD pipelines worldwide.

Instead of leaving behind recognizable fingerprints from public tooling, adversaries can now generate realistic device names that blend naturally into enterprise environments. This blog explores how that changes Entra ID detection and what are the behavioral signals that still expose these attacks.

Analysis of three DNS evasion techniques used by an AI agent in the July 2026 Hugging Face-OpenAI intrusion: in-process resolver monkey-patching, /etc/resolv.conf override to 8.8.8.8, and /etc/hosts pinning to bypass egress controls and FQDN-based firewalls.

Run GitHub Actions jobs in Cloudflare Containers.

Always-on, cross-platform telemetry daemon for AI agent activity. Sysmon for AI agents. You can also check out the companion blog post.

Opinionated Oxlint rules for rejecting low-evidence TypeScript and JavaScript patterns.

Review-first terminal diff viewer for agentic coders.

AWS Security Hub Extended adds Supply Chain Security as its 10th category, growing from 14 to 23 curated partners. New partners Chainguard and Socket address software supply chain risk via hardened open source rebuilds and behavioral package analysis, with findings flowing into Security Hub via OCSF.

AgentCore Gateway supports OAuth 2.0, IAM, and API keys natively, but a request Lambda interceptor enables legacy Basic Auth integration. The interceptor validates the inbound JWT, retrieves system credentials from Secrets Manager, and constructs the Basic Auth header before forwarding to the downstream tool.

This blog describes the methodology that powers a Mandiant internal tool for point-in-time AI vulnerability discovery. It has discovered hundreds of vulnerabilities in customer codebases and resulted in dozens of vendor notifications with either assigned or pending CVE numbers.