Cloudflare Managed Defense uses a team of specialized AI agents built on Workers and global network telemetry to analyze security alerts. By separating deterministic evidence collection from model inference, the system delivers grounded recommendations to analysts.

Atlassian's shared their own version of an AI SDLC playbook, which outlines transforming the full dev lifecycle using agentic AI, requiring two platform investments (context graph, measurement) and workflow shifts across planning, design, development, review, and maintenance, with humans retaining governance and judgment.

Private beta guidance from Anthropic: run autonomous agents in hardware-virtualized sandboxes, one microVM per agent; keep credentials out of agent environments; use auto mode as extra check; retain transcripts 30+ days; report out-of-scope behavior.

Uber built MCP Gateway, a centralized microservice hosting 800+ MCP servers and 5000+ tools. It auto-discovers internal APIs via IDL crawling, translates HTTP/gRPC/TChannel calls to MCP, enforces auth/redaction, and provides runtime discovery via Omni MCP to reduce agent context bloat.

Socket uncovered a GlassWorm-linked cluster of malicious VS Code themes spanning VS Code Marketplace and Open VSX. Extensions like Coca-Cola Christmas and Cosmic Nebula Themes embed obfuscated loaders using AES-256-CBC decryption, Solana dead-drop infrastructure, and Windows command execution to deliver remote payloads.

Five critical Azure cross-tenant privilege escalation vulnerabilities in API Connections (Logic Apps) were found via path traversal in DynamicInvoke, undocumented Dynamic* endpoints, and the host.api.RuntimeUrl parameter, yielding $200,000 in bug bounties.

Nix overlays let you patch any software at any level, from userland tools to OpenSSL, across devenv, Docker images, and NixOS VMs, all from a single source of truth. To be fair, AI makes Nix's steep learning curve far more approachable now.

Agentic AI security scanner that hunts exploitable vulnerabilities like an adversary, proves them with executable PoCs, and fixes them test-first.

Quickly sandbox your AI agent.

Meta bug bounty research tools, in Burp Suite and in your coding agent. You can also check out the companion blog post.

A Deliberately Vulnerable Entra ID Environment.

Strands Box is an open source (Apache 2.0) developer preview sandbox for AI agents. It combines OS-level isolation (such as macOS Seatbelt) with Dogwood policies that govern actions at egress, Python, Shell, and MCP enforcement points.

The article describes a three-layer pipeline that narrows scanner findings through multi-scanner agreement, AST-based structural verification against code, and deployment context from IaC controls such as WAF rules. It outputs a small, prioritized set of evidenced findings, which still needs human review. You can also check out Part 2.

FORGE Lab reports 140 Windows CVEs and 155 validated open-source reports. Three lessons: measure the full pipeline, not just findings; spend reasoning only where it removes uncertainty; and make validation and remediation a continuous learning loop.