AI & vibecoding

What AI coding agents change about your code's security.

Unplugged orange network cables dangling in front of a dark patch rack

AI & vibecoding12 Sept 2026 · 5 min read

21,000 MCP servers exposed on the internet: why authentication is "optional"

Censys counted more than 12,500 internet-reachable MCP servers in April, then more than 21,000 in May. A study published in late July audited 414 of them: 91.8% had no OAuth authentication. How the protocol works, and how things got here.

Computer screen seen at an angle, showing colorful code in a dark room

AI & vibecoding9 Sept 2026 · 6 min read

Prompt injection isn't a bug you patch once

Researcher RyotaK ended up cataloguing around fifty separate ways to bypass Claude Code's permission system. The most critical one let an attacker steal CI/CD secrets in January 2026, starting from a single GitHub issue.

Close-up of a tape library's robotic arm inside a dark data center

AI & vibecoding24 Aug 2026 · 6 min read

When a prompt becomes a shell: what Microsoft found in agent frameworks

In May, Microsoft's Defender research team published two critical CVEs in Semantic Kernel where prompt injection could end in code execution on the host machine. The problem isn't confined to one framework.

Backlit keyboard in the dark, close-up on the command and option keys

AI & vibecoding19 Aug 2026 · 6 min read

The AI assistant blind spot: who's actually allowed to touch your infra

CVE-2026-22708: in Cursor, a plain README or an issue comment was enough to mutate an environment variable and hijack a command the allowlist had already approved, something as ordinary as git branch.