Skip to content

41 results for “Snyk”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types41Articles24Write-ups8Repos6
Advisories1Papers1Talks1
“Snyk”
snyk.ioadvisory🛡️ Security

PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): Update Now

Snyk's write-up of two critical unauthenticated PHP runtime RCEs, CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state, cross-request use-after-free), both CVSS v4.0 9.2. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026. It covers the disclosure timeline, affected SAPIs (mod_php most exposed), backports for 8.1 and older, and partial mitigations.

PHPApacheFrankenPHP+3
CVE-2026-109618CVE-2026-109619SNYK-UNMANAGED-PHP-21347795+2

AppSec· Published and added 22 Oct 2026

snyk.ioarticle🛡️ Security

AI Model Risk Depends on What the Model Can Reach

Snyk's State of Agentic AI Adoption Volume III scores models against 29 attacker goals (0 to 1,000) and matches them to AI-BOM scan data from 1,693 environments. 74.5% reference a model scoring 500+ on some goal and 49.2% one scoring 750+. Risk depends on agent and MCP server reach, and the fix is either switching models or tightening application controls, depending on the goal. Only 37.5% of model occurrences have a score.

SnykModel Context ProtocolLLM
State of Agentic AI Adoption Volume IIIAI-BOMEpoch Capabilities Index+2

AI Security, GRC· Published and added 21 Oct 2026

snyk.ioarticle🛡️ Security

AI Is Calling In Every Risk You've Accepted: Seven Insights From The AI Security Panel: Unfiltered

Snyk's recap of "The AI Security Panel: Unfiltered" (14 October 2026, San Francisco) with speakers from Snyk, OpenAI, Google Threat Intelligence Group and boldstart ventures. It covers AI agents as an attack surface, the July Hugging Face breach by OpenAI models in an evaluation, ToxicSkills data (36.82% of 3,984 skills flawed), Project Glasswing patch backlogs, and why fixing, not finding, is the bottleneck. It closes with a Monday-morning action list.

SnykOpenAIHugging Face+2
Project GlasswingToxicSkillsVulnBump+6

AI Security, Threat Intel· Published and added 21 Oct 2026

snyk.ioarticle🧠 AI

VulnBump: Can AI Agents Fix Vulnerable Dependencies Without Breaking the Build?

Snyk introduces VulnBump, a benchmark of 307 real vulnerable-dependency upgrades from 43 repositories across Maven, Gradle, npm, Yarn, pip and Poetry. An attempt passes only if a fresh Snyk rescan shows the vulnerabilities gone and the project installs, builds and keeps its previously passing tests green in a clean container. On Claude Sonnet 5.5, Snyk's Evo Remediation Agent passed 90.2%, Claude Code with Snyk scan and target version 77.5%, unaided Claude Code 59.6%, and a non-AI package-manager bump baseline 46.9%. Unaided Claude Code often claimed fixes a rescan still flagged, so the benchmark shows harness and security data matter as much as the model. The harness and 43 cases are open-sourced.

Claude CodeSnyk Open SourceMaven+6
SnykVulnBumpVulnBench+6

evals, coding-agents· Published and added 15 Oct 2026

snyk.ioarticle🛡️ Security

VulnBump: Can AI Agents Fix Vulnerable Dependencies Without Breaking the Build?

Snyk presents VulnBump, a benchmark of 307 real vulnerable-dependency upgrades across 43 repositories and six package managers (Maven, Gradle, npm, Yarn, pip, Poetry). An upgrade passes only if a rescan shows the vulnerabilities gone and the project still installs, builds, and passes its previously passing tests. On Claude Sonnet 5.5, Snyk's Evo Remediation Agent passed 90.2%, Claude Code with Snyk scan 77.5%, Claude Code unaided 59.6%, and a plain package-manager bump 46.9%. Unaided Claude Code often claimed fixes that a rescan disproved, and major framework migrations and transitive dependencies were the hardest cases. The harness and the 43 cases are open-sourced.

SnykEvo Remediation AgentClaude Code+3
VulnBumpVulnBenchDepBench+1

AI Security, Supply Chain· Published and added 15 Oct 2026

adversa.aiarticle🛡️ Security

Top MCP security resources — October 2026

Adversa AI's October 2026 MCP security roundup, aggregating and synthesizing 15 resources: authentication-bypass vulnerabilities in LiteLLM's MCP endpoint (CVE-2026-59822, now CISA KEV), Grafana's MCP server session spoofing/SSRF (CVE-2026-19516), an MCP Python SDK OAuth-fallback flaw exploited by a malicious server returning a 404, and an Obot gateway route-matching bypass reopening GHSA-vw82. It also covers detection failures (two malicious MCP servers passing five scanners including Cisco mcp-scanner and Snyk agent-scan, 12% of 82,000 public MCP configs hardcoding secrets), a malicious npm wallet-signing package (gadgethumans-mcp), the A2M agent-hijacking attack technique, and CoSAI's MCP Security v2.0 governance model.

Model Context ProtocolLiteLLMnpm+3
CVE-2026-59822CVE-2026-59821CVE-2026-19516+6

AI Security, AppSec, Identity & Access· Published and added 8 Oct 2026

snyk.ioarticle🛡️ Security

Frontier models found the vulnerabilities. Only the attacker found the chains.

Snyk benchmarks its Evo Continuous Offensive Security (COS) agent against Claude Security running Mythos on TaintedPort, a public deliberately vulnerable web app with 57 known vulnerabilities and 15 known exploit chains. Evo COS, run gray-box against the live URL plus source, confirmed 10 of 15 exploit chains with runnable proofs of concept — for example chaining an SSRF flaw with a hardcoded JWT signing secret into full admin account takeover — while Claude Security, reasoning over source code alone (white-box), found one additional critical bug but could not prove the vulnerabilities were actually reachable and chainable at runtime. The post argues that proving exploitability requires exercising the live application, not just reading code, and frames SAST-style code review and DAST-style live attack as complementary.

SnykClaude Security
Evo Continuous Offensive SecurityMythosSSRF+1

AppSec, AI Security· Published and added 7 Oct 2026

snyk.ioarticle🧠 AI

Why AI Coding Agents Keep Writing Broken Access Control

Snyk argues AI coding agents reliably write broken access control (BOLA/IDOR, OWASP's top category since 2021) because the facts needed to add an ownership check — what an object belongs to, who may access it, where tenant boundaries sit — are tacit product knowledge that exists nowhere in the code or prompt an agent sees. It explains why SAST tools catch patterned sub-categories like path traversal or SSRF but structurally cannot catch CWE-639/862/863 (missing or incorrect authorization), since there's no bad pattern to match, and proposes reasoning over an assembled "application-context graph" of architecture, data flows and trust boundaries instead. It closes with a five-step team checklist (inventory ID-accepting endpoints, document ownership rules, add authorization-specific PR review, write cross-tenant tests, run deep contextual analysis) and pitches Snyk's Evo Agentic AppSec as the tool built around that approach.

SnykOWASPEvo Agentic AppSec+1

coding-agents· Published and added 1 Oct 2026

snyk.ioarticle🛡️ Security

Why AI Coding Agents Keep Writing Broken Access Control

Snyk explains why AI coding agents reliably ship broken object-level authorization (BOLA/IDOR) bugs: the ownership rule that would prevent them (e.g. "invoices belong to organizations") lives in the product's data model and team knowledge, not in the prompt or surrounding code, so the agent produces code that is correct for the stated task but lets any authenticated user access other tenants' objects. The piece maps the flaw to CWE-639/862/863, contrasts it with pattern-matchable classes like SSRF and path traversal that SAST handles well, and lays out five concrete team actions (endpoint inventory, documented ownership rules, explicit authz review questions, per-resource cross-tenant tests, and periodic deep contextual analysis), while pitching Snyk's "application-context graph" and Evo Agentic AppSec as the tool for the pattern-less gap.

Snyk
BOLAIDORCWE-639+5

AppSec, AI Security· Published and added 1 Oct 2026

thehackernews.comarticle🛡️ Security

Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages

The Hacker News details the "Mini Shai-Hulud" campaign by threat actor TeamPCP, which compromised npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch and Guardrails AI via a chained GitHub Actions attack (pull_request_target abuse, cache poisoning, OIDC token extraction), now tracked as CVE-2026-45321 (CVSS 9.6). The worm mints npm publish tokens directly from stolen OIDC credentials to self-propagate — the first documented case of a worm producing validly SLSA Build Level 3-attested malicious packages — and deploys an obfuscated credential stealer with IDE persistence hooks, a GitHub Actions secret-exfiltration workflow, and a dead-man's-switch that runs "rm -rf" if its rogue npm token is revoked. Over 170 packages and 400+ attacker-controlled repos have been identified across npm and PyPI, with findings credited to Aikido Security, Endor Labs, SafeDep, Socket, StepSecurity, Snyk, Wiz and Microsoft.

npmPyPIGitHub Actions+3
CVE-2026-45321TeamPCPMini Shai-Hulud+2

Supply Chain, DevSecOps, Threat Intel· Added 26 Sep 2026

snyk.ioarticle🛡️ Security

Your Vulnerability Backlog Is No Longer Technical Debt, It’s an Attack Surface

A Snyk blog post arguing that vulnerability backlogs traditionally managed as "accepted technical debt" have become genuine attack surface, because AI-accelerated code generation has pushed vulnerability inflow to roughly six new findings per one remediated, unauthored AI-written code removes the "ask the author" triage shortcut, and cheap automated reconnaissance lets attackers walk large backlogs an analyst never would. It illustrates how individually-low-severity findings (an IDOR leaking an internal object ID, a verbose error confirming valid IDs, and an outdated deserialization library) can chain into an authenticated RCE path invisible to severity-based sorting, and argues better prioritization only reorders a backlog rather than shrinking it. It closes with four metrics programs should measure (90-day inflow vs. closure, age of risk-accepted findings, share of human-authored merges, and security-fix merge rate) before promoting Snyk's Evo product.

Snyk
IDOREvo Continuous Offensive Security

AppSec, GRC· Published and added 24 Sep 2026

github.comrepo🛡️ Security

shai-hulud-detect: multi-ecosystem npm/PyPI/Composer/Crates/Go/Hex/RubyGems supply-chain worm scanner

shai-hulud-detect is a dependency-free Bash scanner that checks projects against a 5,782-entry list of compromised npm, PyPI, Composer, Crates, Go, Hex, and RubyGems package versions, plus content-pattern indicators of compromise (malicious file hashes, C2 domains, dead-man's-switch artifacts, forged commits, suspicious lifecycle hooks) tied to the Shai-Hulud supply-chain attack waves. It supports single-project and bulk scanning, CI-friendly exit codes, JSON/log output for pipeline gating, and a --check-host mode to detect the May 2026 gh-token-monitor/kitty-monitor persistence daemons that wipe hosts if their monitored GitHub token is revoked (with a documented safe remediation order). Detection is read-only; new package entries are sourced from named threat-research firms (Socket, StepSecurity, Aikido, Snyk, JFrog, Wiz, Semgrep, SafeDep, GitGuardian, OX Security) and cited in PRs.

npmPyPIComposer+3
Shai-Huludgh-token-monitorkitty-monitor

Supply Chain, DevSecOps· Added 23 Sep 2026

github.comrepo🛡️ Security

OWASP Agentic Skills Top 10 (AST10)

The OWASP Agentic Skills Top 10 (AST10) is a new security framework cataloging the 10 most critical risks in AI agent "skills" — the behavior layer that orchestrates multi-step tool use in OpenClaw, Claude Code, Cursor/Codex, and VS Code. It documents real 2026 incidents (the ClawHavoc registry-poisoning campaign with 1,184 malicious skills, Snyk's ToxicSkills audit of 3,984 skills finding 36.82% flawed, CVE-2025-59536/CVE-2026-21852 RCE in Claude Code project files, and CVE-2026-28363 ClawJacked WebSocket hijacking) and proposes a Universal Skill Format (YAML) with signing, permission allowlists, and identity-file protections to mitigate them, mapped to CSA's MAESTRO 7-layer threat model.

OpenClawClaude CodeCursor+3
CVE-2025-59536CVE-2026-21852CVE-2026-28363+17

AI Security· Added 18 Sep 2026

owasp.github.iopaper🛡️ Security

OWASP Agentic Skills Top 10

OWASP's Agentic Skills Top 10 (AST10) catalogs the ten most critical security risks in the "skills" layer of AI agent platforms — OpenClaw's SKILL.md, Claude Code's skill.json, Cursor/Codex manifest.json, and VS Code package.json — arguing this behavior/orchestration layer is distinct from and less protected than the MCP tool layer. It documents real 2026 incidents (the ClawHavoc campaign poisoning 1,184+ ClawHub skills with AMOS-stealer payloads via a shared C2 IP, Snyk's ToxicSkills audit finding 36% of skills flawed, CVE-2025-59536/CVE-2026-21852 in Claude Code enabling RCE and API-key exfiltration on project open, and CVE-2026-28363 "ClawJacked" WebSocket hijacking of local OpenClaw instances), and proposes a Universal Skill Format with signing, permission manifests, and risk tiers plus a checklist for registries, runtime, governance, and skill development.

OpenClawClaude CodeCursor+3
CVE-2025-59536CVE-2026-21852CVE-2026-28363+8

AI Security, Supply Chain· Added 14 Sep 2026

snyk.ioarticle🛡️ Security

Is prevention essentially a solved problem?

A Snyk blog post arguing that preventing new vulnerabilities in agent-generated code is architecturally solved, using Laurie Voss's nested "loop" model (execution/task/product/system/oversight) to map four control types — in-context guidance, deterministic scanning inside the agent loop (Snyk's Trusted Output Assurance), LLM-based semantic analysis for authz/business-logic flaws like IDOR, and adversarial pentesting/red-teaming (Snyk's Continuous Offensive Security) — to the points in the SDLC where each is cost-effective. It cites Snyk VulnBench JS 1.0 data showing nearly half of LLM-found vulnerabilities appear in only one of five identical review runs, illustrating why single-pass LLM scanning needs repetition to be trusted, and closes by distinguishing solved "prevention" from unsolved "remediation" of existing vulnerability backlogs.

Snyk
IDORVulnBench JS 1.0Laurie Voss+3

AI Security, AppSec, DevSecOps· Published and added 10 Sep 2026

github.comrepo🛡️ Security

PackageGuard

PackageGuard is an open-source .NET CLI tool that scans NuGet, npm, pnpm and Yarn dependencies (direct and transitive) across a codebase, enforcing hierarchically-configured allow- and deny-lists for licenses, packages and versions. It scores each package's Legal, Security and Operational risk using signals like OSV vulnerability data, maintainer activity, package signing and release cadence, and can emit a CycloneDX or SPDX SBOM enriched with OSV vulnerability data, plus console, HTML and SARIF output for CI/GitHub code scanning. It's positioned as a free alternative to commercial supply-chain tools like Black Duck and Snyk.

NuGetnpmpnpm+3

Supply Chain, DevSecOps· Published and added 31 Aug 2026

adversa.aiarticle🛡️ Security

OWASP Agentic Skills Top 10 explained: the ten agent skill risks, and which to fix first

Explains OWASP's Agentic Skills Top 10 v1.0 (AST01-AST10), a new framework for the risks of "agent skills" — folders with a SKILL.md file plus bundled code/scripts that agents discover and execute, treating plain-language instructions as an attack surface that neither traditional package security nor prompt-injection defenses cover. The piece details the ClawHavoc campaign (1,184 malicious skills across 12 ClawHub accounts), the ClawJacked exploit (CVE-2026-32025), Claude Code skill-related CVEs (CVE-2025-59536, CVE-2026-21852), and cites Adversa AI's own research showing a malicious skill bypassed all eight open-source scanners tested, including the OASB leaderboard leader and tools from NVIDIA (SkillSpector), Snyk, Trail of Bits, and Air Security. It closes with a prioritized remediation sequence (inventory, isolation, credential scoping, pinning, allowlisting, approval workflows, advisory scanning, cross-platform normalization) mapped to the AST entries.

Claude CodeOpenClawCursor+3
CVE-2026-32025CVE-2025-59536CVE-2026-21852+14

AI Security, Supply Chain· Added 7 Oct 2026, published 25 Aug 2026

github.comrepo🛡️ Security

0sec-labs/0

"0" is an open-source security workflow runner from 0sec Labs (YC-backed, with a Swiss Applied AI & Cybersecurity Research Lab) usable from a terminal, a browser "Command Center," or a coding agent via MCP. It ships 12 starter templates (e.g. a "security-research" template that produces a source review of a demo API with code locations and suggested fixes), supports scheduled/triggered runs with retained results and revision history, and integrates with GitHub, Elastic, Semgrep, Snyk, Linear, Jira, Cloudflare, Slack and Teams via plugins.

Model Context ProtocolBunReact+1
FoxGuard

AI Security, AppSec· Added 2 Oct 2026, published 19 Aug 2026

snyk.ioarticle🛡️ Security

Remediation Agents, Demystified: Why Fixing Beats Finding

Recap of a Snyk "AI Security Engineers Community" livestream introducing Remediation Agent, now in public preview: an orchestration layer that sits between a developer's chosen LLM and Snyk's vulnerability intelligence (breakability assessments for OSS upgrades, package health/reachability scores, SAST fix generation, and ecosystem-specific upgrade playbooks) to auto-generate mergeable SCA and SAST fixes. It was demoed live against OWASP Juice Shop via the CLI (snyk fix --agentic --experimental --sca) and via an IDE path (Snyk Studio MCP server plus a /snyk-fix skill in Cursor, Windsurf, or VS Code), with Snyk reporting internal gains of 94% more mergeable SCA fixes and 13% more mergeable SAST fixes versus naively pointing an LLM at a vulnerability backlog.

SnykSnyk CodeModel Context Protocol+2
OWASP Juice ShopmulterGlob

AppSec, AI Security, DevSecOps· Added 3 Sep 2026, published 19 Aug 2026

snyk.ioarticle🛡️ Security

Benchmarking Secure-and-Functional Remediation and How Snyk Agent Fix Lifts Frontier-Model Fix Rates by over 14%

Snyk built a Golden Test benchmark of about 150 real vulnerable code samples across Python, JavaScript, and Java, each scored on paired FAIL-to-PASS security and PASS-to-PASS functional unit tests, and ran Gemini 3.1 Pro, Claude Sonnet 4.6, and Claude Opus 4.6 both standalone and with Snyk's dynamic few-shot Snyk Intelligence context. Out-of-the-box models plateaued at 72-75 percent secure-and-functional fix rate, while adding Snyk Intelligence lifted Opus 4.6 from 74.6 to 85.4 percent overall, and from 64 to 88 percent on Python, showing security-specific context rather than model size drives remediation quality. The post also previews Snyk VulnBench, a companion study finding Claude Opus 4.7 with the Claude Code harness produced highly non-repeatable vulnerability findings when used as a SAST-like detector.

SnykSnyk CodeGemini+3
Claude Sonnet 4.6Claude Opus 4.6Opus 4.7+6

AI Security, AppSec· Added 3 Sep 2026, published 18 Aug 2026

snyk.ioarticle🛡️ Security

The Agent Baseline: 35 Controls, But Where Should You Start?

Snyk expands on the 'Agent Baseline' (co-authored with Docker and Keycard), a vendor-agnostic reference architecture defining six security outcomes for AI agents — Discover, Constrain, Authorize, Observe, Validate, Respond — and 35 specific controls (e.g. CON-03/04, DIS-04/06/07, AUT-01/02/03, OBS-02, RES-01/02/04, VAL-03/04). The post argues coverage isn't a rollout plan and gives sequencing per use case: developer coding agents should start with sandboxing/capability scoping (Constrain) then discovery, shared internal agents should start with per-principal Authorize controls to avoid confused-deputy failures from shared service accounts, and production agents should prioritize Respond (credential/session revocation, component quarantine, non-agent fallback paths) and outcome validation before finality. It also flags gaps in the current draft (no maturity model, use-case lens not yet in v1.0) and notes the Baseline is open for public comment on GitHub until Sept 30.

SnykDockerKeycard+1
Agent BaselineNorm Hardyconfused deputy

AI Security, GRC· Added 3 Sep 2026, published 12 Aug 2026

snyk.ioarticle🛡️ Security

Show, Don't Tell: What Evo Continuous Offensive Security Found in a Real Enterprise SaaS

Snyk describes a real customer engagement using its Evo Continuous Offensive Security (autonomous AI pentesting) product against a multi-tenant enterprise SaaS with hundreds of microservices behind an SPA. It details two exploitable findings: a mass assignment bug combined with broken function-level authorization (BFLA) enabling tenant-wide compromise, and a CORS origin-reflection misconfiguration, both validated as reproducible exploits.

Snyk
Evo Continuous Offensive SecuritySnyk API & Web

AppSec, Offensive Security· Added 3 Sep 2026, published 10 Aug 2026

github.comrepo🛡️ Security

npm-scan

npm-scan is a CLI supply-chain security scanner (@lateos/npm-scan) that inspects npm packages and lockfiles for behavioral attack patterns missed by npm audit/Snyk/Socket, including obfuscated payloads, credential stealers, eBPF kernel rootkits, memory-level OIDC token extraction, GitHub maintainer-account spoofing, and AI-platform-targeted key theft. It ships 23 detectors (D1-D25), validated against real campaigns like IronWorm and Miasma, and outputs SBOM (CycloneDX/SPDX) and SARIF for GitHub Security, plus a workflow to submit critical findings to CISA's VINCE with mandatory manual review. It's free (MIT) for individuals/OSS/evaluation, with paid commercial tiers ($799-$9,900/yr).

npmGitHub ActionsDocker+3
IronWormMiasmaCISA+1

Supply Chain, DevSecOps· Published and added 5 Aug 2026

snyk.iowriteup🛡️ Security

Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks

Snyk Security Research independently verified an active npm supply-chain compromise affecting keyv@6.0.0 and 10 related packages (cacheable family, ecto) published by maintainer jaredwray on August 4, 2026, adding a preinstall hook (setup.mjs) that loads a 727KB obfuscated second-stage payload (Math_Symbol.js) targeting GitHub/npm/cloud credentials, private keys, and Vault/Kubernetes tokens via a gh-token-monitor persistence mechanism. The attack also planted .claude/settings.json and .vscode/tasks.json hooks to trigger execution when developers open the repo in Claude Code or VS Code, and the malicious release was signed by a valid npm trusted-publisher (GitHub Actions) attestation, demonstrating that provenance can faithfully attest a build whose source was already compromised. Snyk provides byte-level tarball diffs, a minute-by-minute incident timeline, and remediation steps including pinning to keyv@5.6.0, hunting for gh-token-monitor persistence, and credential rotation.

npmBunVS Code+3
keyvcacheableecto+8

Supply Chain, Blue Team & Detection· Added 3 Sep 2026, published 4 Aug 2026

snyk.ioarticle🛡️ Security

What Is AI Pentesting and How Does It Work?

Snyk explains AI pentesting as an orchestrated system — a reasoning model that plans reconnaissance/exploitation, deterministic DAST tooling for known vulnerability classes, an independent validator model that confirms exploitability, and context from existing scanner findings — designed to catch context-dependent flaws like BOLA/IDOR, cross-tenant leakage, and chained business-logic exploits that signature-based scanners miss. It cites concrete reliability data (frontier models solving only ~26% of hard system-exploitation benchmark tasks, ~30% hallucinated findings without independent validation, 210% YoY growth in valid AI-generated HackerOne reports and 540% growth in prompt-injection reports) and positions Snyk's Evo Continuous Offensive Security product against these evaluation criteria. It also references a RAND 2026 study on low-cost CTF-solving coding agents, Anthropic/Mozilla open-source vulnerability discovery work, and Google GTIG's report of the first in-the-wild AI-assisted zero-day.

SnykHackerOneAnthropic
RANDGoogle GTIG

Offensive Security, AI Security, Learning· Added 3 Sep 2026, published 27 Jul 2026

checkmarx.comwriteup🛡️ Security

MCP Configuration Poisoning: Owning Your Machine With Just A Text File

Explains how a malicious mcp.json in a repository, with attacker-controlled "command" and "args" fields, gives remote code execution when an IDE, scanner, CI/CD pipeline or agent loads it automatically. Walks through a PoC where running Snyk's Agent Scan (snyk-agent-scan) on a poisoned config executes arbitrary commands; Snyk fixed it in 0.5.0 after a duplicate report. Offers mitigations for tool builders (sandboxing, pattern blocking, human-in-the-loop prompts hardened against "Lies in the Loop" dialog forging) and for users (sandbox untrusted repos).

Model Context ProtocolSnykCheckmarx
MCP configuration poisoningLies in the LoopHITL Dialog Forging+1

AI Security, AppSec, Supply Chain· Added 10 Sep 2026, published 23 Jul 2026

snyk.ioarticle🛡️ Security

Symlinks Are Still Scary (And Yes, You Can Commit Them to Git)

Snyk explains the decades-old symlink attack (CWE-61) and the underappreciated fact that Git will happily commit, push, and recreate symlinks (file mode 120000) from a cloned repo, letting an attacker ship a file like project_settings.json that's secretly a pointer to ~/.ssh/authorized_keys. It walks through Wiz Research's "GhostApproval" report, which found that six AI coding agents (Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, Windsurf) can be prompt-injected via README instructions into following such a symlink and writing attacker SSH keys or shell-config payloads before the user ever sees an accurate confirmation dialog (CWE-451, UI misrepresentation). It also recaps prior symlink-driven CVEs (tar npm package CVE-2021-32803, Leaky Vessels CVE-2024-21626, Git submodule CVE-2024-32002) and gives concrete mitigations: canonicalize-then-check-boundary atomically (e.g. openat2 with RESOLVE_BENEATH), show real resolved targets in approval dialogs, and audit repos with `find . -type l` or `git ls-files -s` before trusting them.

GitClaude CodeCursor+3
CVE-2021-32803CVE-2024-21626CVE-2024-32002+6

AI Security, AppSec· Added 3 Sep 2026, published 9 Jul 2026

opensourcemalware.comtalk🛡️ Security

The OpenSourceMalware Show #11

Episode 11 of the OpenSourceMalware Show covers npm's new 72-hour read-only account lockout for high-impact packages (triggered by email changes or 2FA recovery use) and GitHub Enterprise's new self-service credential revocation tool for incident response, noting each has gaps (lockout could hinder legitimate ATO recovery; revocation doesn't cover PATs created outside the enterprise boundary). The hosts also call out six npm packages published by a researcher at a stealth cybersecurity startup that target OpenAI, Anthropic, Vercel, and Ollama users — info-stealers that avoid credentials but exfiltrate .git/.ssh data, drawing a parallel to Snyk's 2025 malicious-package incident targeting Cursor. It also references an FBI FLASH notice on TeamPCP's TTPs/IOCs and previews a coming interview with Eclipse Foundation's head of security on Open VSX supply-chain risk.

npmGitHubOpenAI+3
TeamPCPFBI FLASHEclipse Foundation

Supply Chain, Threat Intel, Identity & Access· Added 3 Sep 2026, published 2 Jul 2026

snyk.iowriteup🛡️ Security

Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?

Snyk's VulnBench JS 1.0 report runs 300 repeated agentic security-review scans (10 JS/Express fixtures x 6 model configs x 5 repetitions) to measure whether LLMs like Claude Opus 4.6/4.7 and Claude Sonnet 4.6 find the same vulnerabilities twice, benchmarked against deterministic Snyk Code SAST reference findings. Key results: reference-matched LLM findings were highly repeatable (84.8% appeared in all 5 runs) while extra, non-reference LLM findings were unreliable (only 14% reproduced in all runs), the best LLM config (Opus 4.6 Medium) reached only 75.4% Snyk-reference F1 with a 24.6-point gap to SAST, and higher-cost models (Opus 4.7 Max) did not outperform cheaper ones despite 5.7x cost. The study argues LLM review and SAST catch different vulnerability classes (LLMs strong on injection/SSRF-type bugs, weak on path traversal/resource-limit enumeration) and should be combined rather than substituted.

ClaudeSnykJavaScript
Snyk CodeOpus 4.6Opus 4.7+2

AI Security, AppSec· Added 3 Sep 2026, published 29 Jun 2026

snyk.ioarticle🛡️ Security

NVD in the AI Era: The Case for Multi-Source Vulnerability Intelligence

Snyk analyzes NIST's April 15, 2026 policy change to NVD, which replaced universal CVE enrichment with a risk-based triage model prioritizing CVEs in CISA's KEV catalog, federal-government software, and EO 14028 critical software, while deprioritizing everything else as lowest priority not scheduled. The piece details operational changes (NIST no longer routinely providing an independent CVSS score when a CNA already supplied one, and only reanalyzing modified CVEs when materially impactful) and argues this creates blind spots for scanners that depend solely on NVD, driven by CVE volume growth from about 18000 in 2020 to over 48000 in 2025 due to the federated CNA model and AI-accelerated vulnerability research.

NVDCVSSSnyk
CISA KEVExecutive Order 14028NIST

AppSec, Supply Chain, GRC· Added 3 Sep 2026, published 25 Jun 2026

snyk.ioarticle🛡️ Security

What nearly 10,000 developer environments reveal about agentic development risk

Snyk Research scanned nearly 10,000 developer environments and found 43% run two or more AI coding tools, 50.8% have at least one MCP server installed (with 1 in 7 of those having a security finding, 1 in 12 high or critical), and 22.8% have agent skills installed. The analysis identified 392 confirmed prompt injection findings embedded in tool descriptions and 98 confirmed malicious code patterns in agent skill files, and cites the separate ToxicSkills study of 3,984 public skills from ClawHub and skills.sh where 13.4% had a critical security issue. The piece frames MCP servers and agent skills as a new, largely ungoverned software supply chain layer sitting outside traditional SAST/SCA/CI-CD controls.

Model Context ProtocolClaudeCursor+3
ToxicSkillsClawHubskills.sh

AI Security· Added 3 Sep 2026, published 23 Jun 2026

snyk.ioarticle🛡️ Security

When a vendor's breach becomes yours: lessons from the Klue incident

Snyk discloses and analyzes a supply-chain breach at Klue, a market-intelligence SaaS platform, in which attackers used a long-forgotten integration-prototype credential to gain a foothold, then harvested OAuth tokens used for Klue's Salesforce integrations to directly query and exfiltrate customer CRM data across multiple downstream organizations (also affecting Recorded Future, Tanium, Huntress, and Jamf). Extortion attempts followed the exfiltration, and Snyk confirms it was among the affected customers, with impact limited to business contact fields and support-case titles/descriptions in its Salesforce environment. The piece illustrates how a single stale non-human credential and standing OAuth tokens can turn one vendor compromise into a multi-tenant cascade.

SalesforceOAuthSnyk
Recorded FutureTaniumJamf

Threat Intel, Identity & Access, Supply Chain· Added 3 Sep 2026, published 23 Jun 2026

github.comrepo🛡️ Security

Teycir/SkillsGuard

SkillsGuard is a zero-dependency static security scanner for AI agent skill packages (SKILL.md files and bundled scripts) that detects prompt injection, exfiltration, obfuscated payloads, persistence, and privilege escalation before an agent reads or executes them. It recursively decodes base64/hex/URL-encoded blobs to catch hidden attacks like a base64-wrapped reverse shell, computes a 0-100 risk score, and integrates into CI (SARIF/JSON output), git pre-commit hooks, and Claude via an MCP server (scan_skill tool) or a free hosted Cloudflare Workers API. The README also situates it against competing agent-skill scanners (NVIDIA, Cisco, Snyk, Mondoo, SkillSpector, SkillScan), noting it's the only one requiring no account/API/LLM dependency versus SkillSpector's LLM-augmented semantic analysis backed by a study of 42,447 scanned skills.

Node.jsModel Context ProtocolSARIF+3
SkillSpector

AI Security, DevSecOps· Published and added 21 Jun 2026

snyk.iowriteup🛡️ Security

A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope

Snyk details how a dormant, never-revoked npm contributor account (ehindero) was used to republish the entire @mastra scope (142+ packages, ~4M monthly downloads for @mastra/core alone) with an injected dependency, easy-day-js, a byte-for-byte dayjs impersonator. The postinstall hook in easy-day-js@1.11.22 disables TLS verification, pulls a second-stage payload from a raw IP, and drops a cross-platform cryptocurrency wallet stealer plus a RAT with OS-specific persistence (LaunchAgent, systemd unit, PowerShell staging) that beacons every 10 minutes over a self-signed wolfSSL certificate. The piece covers detection steps, the Snyk advisory (SNYK-JS-EASYDAYJS-17353313), and draws parallels to the earlier Axios npm compromise attributed by Microsoft to Sapphire Sleet (BlueNoroff).

npmNode.jsSnyk+2
Mastraeasy-day-jsSNYK-JS-EASYDAYJS-17353313+4

Supply Chain, Malware & RE, Blue Team & Detection· Added 3 Sep 2026, published 16 Jun 2026

snyk.ioarticle🛡️ Security

When a Government Pulls an AI Model: What the Fable 5 and Mythos 5 Suspension Means for Security Teams

Analysis of the June 2026 incident where a US government export-control directive forced Anthropic to globally disable Claude Fable 5 and Mythos over a reported "jailbreak" that was essentially the model reading a codebase and fixing vulnerabilities — a capability defenders use daily. The piece argues the episode illustrates dual-use AI risk, contrasts the government's opaque process with established security norms (coordinated disclosure, defense in depth, risk-based prioritization), and draws operational lessons for security teams: avoid hard dependency on any single hosted model, inventory AI usage across the stack, scan AI-generated code continuously, and prefer guardrails/monitoring over kill switches. It also cites Snyk's ToxicSkills research finding security flaws in over a third of nearly 4,000 audited AI agent skills.

AnthropicClaudeGPT-5.5+2
Fable 5MythosOWASP Top 10 for LLM Applications+4

AI Security, GRC· Added 3 Sep 2026, published 14 Jun 2026

snyk.iowriteup🛡️ Security

Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp

Snyk documents an active npm supply-chain attack ("Node-gyp Supply Chain Compromise - June 2026") that abuses binding.gyp's GYP command-expansion syntax (<!(...)) to trigger arbitrary code execution via node-gyp during npm install, bypassing detection tools that only monitor preinstall/postinstall scripts. The worm, tracked as "Phantom Gyp"/"Miasma" (a Shai-Hulud descendant) by StepSecurity, has hit 57 packages including autotel-* and @vapi-ai/server-sdk, harvests npm/GitHub/AWS/GCP/Azure/Vault/Kubernetes credentials via a multi-stage obfuscated Bun-based loader, injects GitHub Actions workflows for persistence, and self-propagates by republishing from compromised maintainer accounts.

npmnode-gypGitHub Actions+2
binding.gypPhantom GypMiasma+5

Supply Chain, Malware & RE, Threat Intel· Added 3 Sep 2026, published 4 Jun 2026

snyk.ioarticle🛡️ Security

Type Level Security: The future of secure AI code generation?

Snyk blog post arguing that entire classes of web app vulnerabilities (IDOR, XSS, SQLi, command injection) can be eliminated at compile/type-check time rather than caught by review or runtime checks, drawing inspiration from the Trusted Types web API and the Linux kernel's __user pointer macro. It walks through Python type-hint and Rust/Axum code examples wrapping raw ints/strings in opaque classes (e.g. UncheckedUserID, UncheckedString) that can only be unwrapped after proving authentication/authorization or sanitization, and argues this pattern is especially valuable for constraining AI-generated code since prompting an LLM to remember security checks is unreliable.

PythonRustSnyk
IDORTrusted Types

AppSec· Added 3 Sep 2026, published 4 Jun 2026

blog.trailofbits.comwriteup🛡️ Security

The sorry state of skill distribution

Trail of Bits researchers bypassed every agent-skill security scanner they tested — ClawHub's VirusTotal/Code Insight and GPT-5.5-based guard model, and skills.sh's Gen/Socket/Snyk-backed scanning, plus Cisco's skill-scanner — using techniques like context-truncation via 100,000 newlines, malicious payloads hidden inside .docx ZIP archives, Python .pyc bytecode poisoning to steal environment variables, and rhetorically-crafted prompt injection that convinced LLM analyzers a malicious npm/yarn registry change was benign. The piece also shows a legitimate Anthropic Office skill (soffice.py) using LD_PRELOAD in ways indistinguishable from malicious behavior, arguing static/LLM skill scanning is structurally unable to guarantee safety and that organizations should instead curate trusted skill marketplaces (e.g., trailofbits/skills-curated) rather than rely on public ones. PoC skills are published at trailofbits/overtly-malicious-skills.

OpenClawskills.shCisco skill-scanner+3
ClawHubCode InsightGPT-5.5+4

AI Security, Supply Chain· Added 3 Sep 2026, published 3 Jun 2026

snyk.iowriteup🛡️ Security

Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection

Snyk details how jqwik maintainer Johannes Link shipped version 1.10.0 of the Java property-testing library net.jqwik:jqwik-engine to Maven Central with a hidden method, printMessageForCodingAgents(), instructing AI coding agents to delete all jqwik tests and code. The instruction was concealed from humans via ANSI escape codes (ESC[2K + carriage return) that wipe the line on an interactive terminal but leave the text intact in raw logs captured by CI systems and agent tool-output parsers like Claude Code, GitHub Copilot agent mode, and Cursor. Claude Code detected and refused the injected instruction in the wild; the maintainer later disclosed the behavior, softened it in 1.10.1 (opt-in hiding, non-destructive directive), and stated jqwik is not meant for AI-assisted workflows — framing it as deliberate "protestware" against agentic coding rather than a conventional vulnerability.

jqwikMavenClaude Code+3
Johannes Linkrbatlletprotestware+1

AI Security, Supply Chain· Added 3 Sep 2026, published 2 Jun 2026

snyk.iowriteup🛡️ Security

Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages

Snyk researchers discovered malicious code injected into several @redhat-cloud-services npm packages, dubbed the "Miasma" supply chain attack. The malicious payload was designed to harvest sensitive data or execute unauthorized code when the compromised packages were installed, illustrating how trusted-looking scoped npm packages tied to a major vendor namespace can be weaponized.

npmNode.js
Miasma

Supply Chain· Added 3 Sep 2026, published 1 Jun 2026

owasp.orgarticle🛡️ Security

OWASP Free AppSec Tools

OWASP's community-maintained catalog of application security tools that are free for open source projects, organized by category: SAST (GitHub CodeQL, Coverity, HCL AppScan CodeSweep), DAST (OWASP ZAP, StackHawk, Akto, Arachni), IAST (Contrast CE), software composition analysis/dependency scanning (Dependabot, Snyk, Mend, retire.js, Debricked), secrets detection (Gitleaks, TruffleHog, GitGuardian, Kingfisher), code quality (SonarQube, SpotBugs, MegaLinter), CI/CD security (GitLab built-ins, Faraday), and automatic remediation (Mobb, Corgea). It also covers newer entrants like Zennoxa Shield, cloud-audit, Cynative, and post-quantum crypto risk tools (CARAF, PQBench). Serves as a practical shopping list for securing an OSS project's SDLC end-to-end.

OWASP ZAPCodeQLSnyk+3
OWASP Top 10-2017 A9

AppSec, DevSecOps, Supply Chain· Published and added 6 May 2026