Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
At Black Hat on 5 August 2026, Novee showed an unprivileged GitHub issue reaching CI secrets through Claude Code, Gemini CLI and OpenAI Codex workflows.
Claude Code 2.1.163, Gemini CLI 0.39.1, run-gemini-cli 0.1.22 and Cursor 3.0 all carry fixes for 2026 agent flaws. Here is how to enforce those minimums in CI and on laptops.
A test plan for chatbots and agents built into your product: direct and indirect injection, excessive agency, cross-user data, and output handling, mapped to OWASP's 2025 LLM Top 10.
A peft advisory published 5 August 2026 shows how one unguarded torch.load call undoes a project's own safe-loading wrapper. Here is how to load models without executing code.
The 2026 edition reorders the list and renames System Prompt Leakage. Here are all ten entries with one concrete engineering control each, plus where the list stops and the agentic list begins.
The 2026-07-28 MCP revision changes auth, deprecates Dynamic Client Registration and removes sessions. Use it and the spec's security page as a checklist before you approve a server.
OWASP moved Excessive Agency to third place in its August 2026 LLM list. Here is a short, concrete way to scope what an agent's tools can do.
A Qdrant advisory shows a read-only credential can still write files on the vector store host. Use it to review every stage of your RAG pipeline.
Three 2026 documents point the same way on agent audit trails. Here is a minimum log record you can add today, with tool calls tied to a human and a trace.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
