Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
September's VS Code fixes include CVE-2026-81380, where prompt injection could make Copilot agent mode send environment variables out, and four agent network policy bypasses.
Elastic traced @apexacc/cli and @apexacc/audit to a fake Web3 accelerator. The CLI dropped stealers and sent the coding agent's model traffic and MCP calls to attacker servers.
A fallback in LiteLLM's MCP auth let any made-up Bearer token open an authenticated MCP session. Fixed in 1.84.0; CISA added it to KEV on 2 September 2026.
Every Safeguard MCP tool call is now checked at tenant, organization, role and agent level. New tenants start with reads on and writes off.
Your support chatbot can now issue refunds and look up orders, because someone connected it to real tools. Every one of those actions sits behind a customer-facing text box, protected however carefully the prompt was worded.
Prompt injection in a single turn affects one response, then the next request starts clean. A persistent memory feature breaks that boundary by design, so a single successful injection becomes durable, recalled and trusted in every future session.
Give a model a tool that writes and you have added a route into whatever sits behind it. The design that keeps it a new shape rather than a new privilege, and the four things that were not obvious.
Commit-level attribution answers 'lines added by commits an assistant co-authored'. That is a different sentence from 'lines an AI wrote', and the gap between them is where governance metrics go wrong.
Coding assistants sign their own work in the commit trailer block. That makes 'how much of this was AI-written' a parsing problem, not a heuristic one — as long as your tooling reads the commit body, which most of it does not.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
