A policy document does not stop an AI agent; limits must sit in the infrastructure

Logs, tickets and docs are an attack route for coding agents, a Coder engineer argues

Malware now writes instructions to the AI that analyzes it, Talos finds

Latest intelligence

87% of Organisations Suffered an API Security Incident. The Worse Number Is the One That Went Down.

Akamai's 2026 study of 1,840 security leaders reveals that only 23% know which APIs return sensitive data — down from 40% in 2022. Organisations are spending more on API security and understanding less. AI is accelerating the gap.

The AI-First Web

57.5%: The Dead Internet Arrived 18 Months Early

Security & Trust

Building digital trust starts with infrastructure. The security posture of your framework is the foundation.

All stories →

A policy document does not stop an AI agent; limits must sit in the infrastructure

Gravity's CTO showed on AI Engineer that an agent acts on its permissions, not on written rules.

Logs, tickets and docs are an attack route for coding agents, a Coder engineer argues

Michael Patterson of Coder argues agents trust what they read, so logs, tickets and docs can carry hidden orders.

Malware now writes instructions to the AI that analyzes it, Talos finds

Cisco Talos tracked 'A3' evasion for 18 months. The defense echoes how one bank protected unpatchable check printers.

10M+

sites analysed

1046

insights published

frameworks tracked

regional editions

The AI-First Web

The web is being rebuilt for machine consumption. What that means for every business building online.

All stories →

Microsoft researchers train AI agents inside the real harness they will run in

Agent Lightning v1.0 trains agents in the same harness they will be deployed in, not a rebuilt copy

Claude bypassed limits on real sites; Anthropic cut web access for its tests

Some cases came from regular use, not only tests. Fees and error pages assume a visitor who gives up; Claude did not.

Meta's Muse agent limits what attackers can take, not what Meta can see

Muse's design bounds the damage from a hijacked agent. Keeping data from the vendor is still a promise.

Cost of Legacy

The hidden costs holding businesses back. How modern infrastructure unlocks speed, savings, and scale.

All stories →

AI agent harnesses are old workflow engines with the plan written later

Orkes CTO Viren Baraiya says the safe way to run agents borrows from workflow ideas that already exist.

A twice-a-year pen test leaves long gaps while code ships nonstop

Eli Cohen of Snyk argues that testing by calendar cannot match code shipped nonstop and attackers who never pause.

AssemblyAI could not fix its bought support bot fast enough; it solved about 10%

Matt Lawler says a bought bot solved about 10%; AssemblyAI's own agent reached 80% in week one, by its account.

Modern Stack

The technologies enabling the next wave of digital business. What leaders are building on and why.

All stories →

GitHub's pipeline agents leave developers approving and accepting, not coding

Jose Palafox of GitHub showed a flow where slash commands and acceptance reviews replace hands-on coding.

Cloudflare's cheaper AI decision model can read less text per request

Clef-flash now costs $0.038 per million input tokens. The hosted version's input limit fell from 64k to 24k tokens.

Bun 1.4.3 adds a type-check gate and enforces a flag it once ignored

A faster type checker is the headline. The quieter fix shows why security settings need testing.

Framework Migration

Moving from legacy to modern isn't just a tech upgrade. It's a competitive advantage.

All stories →

Telangana swapped Oracle for PostgreSQL on a live citizen platform

Security & Trust

June 2026: Six CVSS 9.8 Vulnerabilities. 1.14 Million WordPress Sites.

Claude bypassed limits on real sites; Anthropic cut web access for its tests

Meta's Muse agent limits what attackers can take, not what Meta can see

In tests, AI-run decoy servers kept attack bots busy far longer than scripts

A fake security workflow now mines whole git histories for credentials

Postman and AWS say missing context, more than missing tools, broke its AI agent

Cloudflare's cheaper AI decision model can read less text per request

Oratomic says 10,000 qubits could threaten encryption, not millions

Bun 1.4.3 adds a type-check gate and enforces a flag it once ignored

One AP News article set 618 cookies before the consent banner was answered

Security & Trust

GitHub Enterprise's secret scanner trusted the secrets it was checking

A Snorkel AI researcher says big models stumble on finance data through poor discipline

A Sentry engineer saw coding agents dodge lint rules and inflate coverage

Business Efficiency

AI agent harnesses are old workflow engines with the plan written later

A twice-a-year pen test leaves long gaps while code ships nonstop

AssemblyAI could not fix its bought support bot fast enough; it solved about 10%

Innovation & Growth

AI-built knowledge for coding agents should trace every fact to code or telemetry

A small finance model trained for under $500 in compute beat its 235B sibling

Turn the corrections you keep repeating to a coding agent into automatic checks

The AI-First Web

Anthropic's AI finds suspected bugs faster than its staff can check them

One missed swim-class rule shows the risk of AI errand agents

A copy trained on a hidden-flaw AI's answers confessed the flaw more often

Security & Trust

iRhythm says patient data was stolen from business apps, not clinical systems

iVerify finds DarkSword iPhone variant that steals keychain and wallet data

Attackers exploit AhsayCBS backup flaws; Huntress says 10.3.4 is affected

WorkOS put app security in the platform so non-engineers can ship internal apps

PraisonAI's localhost-only safeguard can be bypassed by a forged Host header

Some malware now carries notes written for the AI tools that analyze it

Apiiro: a 17,610-repo GitHub malware fleet was re-aimed, not rebuilt

Malware aimed at Ukraine was reworked repeatedly, from July 2024 to April 2026

Report: Oracle Health's old Cerner server breach may affect nearly 20 million

An AI model filed a false homicide tip, and its maker found out 2 months later

Only 3.6% of 857 releases from nine Chinese AI labs had safety results

AI refusal is a statistical habit, not a lock. Plan your controls around that

Engineers' skill shifts from writing workflows to constraining agent plans

AWS says its agent payments cap spending outside the AI model's control

Google's new Gemini work agent gets its own email and its own audit trail

Anthropic's Haiku 5.5 cuts short-prompt prices 90%, making agents cheaper

ChatGPT can now build its own interface for an answer, OpenAI says

Exposed LMCache servers can be taken over with one message; no fix yet

Google's EmbeddingGemma 2 puts video and audio search on the device

281 Free VPN Apps, 2.4 Billion Installs, One Shared Incentive Problem

Joomla Ships 644 Commits Per Year. It Still Carries 1,313 CVEs.

UpdraftPlus Auth Bypass: The WordPress Backup Plugin on 3 Million Sites Just Became the Attack Vector. Zero Authentication. An All-Zero Encryption Key. Actively Exploited.

WordPress Backup Plugins Require Admin Access