OWASP Top 10 for LLM Apps 2026: Excessive agency risk on the rise
While prompt injection and data disclosure remain concerns, excessive agency climbed the list — not surprising with recent security incidents.
AppSec & Supply Chain Security
OWASP Top 10 for LLM Apps 2026: Excessive agency risk on the rise
Frontier AI agents: Only as safe as their containment
The post-mortems of two compromises by rogue AI agents show that security teams need to focus on guardrails, not the AI model.
AI domain takeover takeaway: Focus on the harness not the model
Research into an Active Directory takeover with a single AI prompt highlights why organizations need to focus on agentic SOCs.
Why AI coding makes zero trust an AppSec requirement
Traditional SBOMs, signing, and provenance all have blind spots, making them no longer capable of assuring software security.
AI coding agents: A call to action on dependency cooldowns
Delaying software upgrades creates a buffer against poisoned packages, but transitive dependencies continue to be a problem.
Akrites marshals the open source community to counter AI threats
Industry heavyweights bring new focus to vulnerabilities in the age of AI. Here’s how it might help improve security.
New OWASP tool structures AI threat modeling
Threat Advisor could help teams with AI-specific risks. But a broader AppSec strategy rethink is needed in the AI era.
AI-BOM push borrows from the SBOM playbook
The Institute for Security and Technology's 'Driving AI Transparency' policy paper makes the case for AI-BOM minimum requirements.
2026 Gartner® Magic Quadrant™ for Software Supply Chain Security: 5 takeaways
The Magic Quadrant™ for Software Supply Chain Security is a 45-minute read. Here's what we feel security leaders need to pull from it.
Should frontier AI firms fund OSS ecosystem security?
With a ‘vulnpocalypse’ expected, AppSec leaders are calling for the companies to invest in a Great Refactor Fund to secure open source.
Agentic AI risk isn't a model problem. It's an architecture problem.
Agentic AI is moving the perimeter from components to data — and most strategies aren't built for that.
The race to secure AI coding: 4 steps to rein agents in
Coding agents are privileged insiders — with keys to CI/CD pipelines even as they give rise to ‘slopsquatting.’ Here’s how to govern them.
Update to npm blocks install scripts: What it means for AppSec
Disabling scripts by default closes the vector worms like Shai-Hulud rely on. Here's what the update fixes — and what it doesn't.
MCP security tracks API's playbook — we know how that ends
The standard connecting AI agents to tools and data leaves security to others. Make it a do-over.
Dependency remediation bolstered with CVE Lite CLI
OWASP's new dependency scanner gives developers actionable fixes. But supply chain attacks aren’t yet CVEs.