Application Security | Breaking Cybersecurity News | The Hacker News

Artificial intelligence is everywhere now. From automated code completion to autonomous infrastructure management, AI tools and AI agents help DevOps speed up deployment cycles and change how development teams operate in general. At the same time, this rapid adoption of AI has created a reality that is hard for security teams to ignore: as with the growth of AI capability within the software development life cycle, the attack surface also grows. In 2025, there were 68 AI-related incidents recorded across major DevOps platforms according to the 2026 DevOps Threats Unwrapped Report . In the first half of 2026, the number of AI-related incidents visibly grew — research from GitProtect Lab tracked 84 AI-related incidents in six months alone. Thus, comparing the first half of 2026 to the same period in 2025 shows that AI-related incidents in development environments have nearly tripled. What do DevOps and DevSecOps say about AI incidents in general? According to GitProtect Lab 's surve...

Penetration testing is intended to help organizations identify weaknesses before attackers can exploit them. Once testing ends, findings must be documented, reviewed, formatted, delivered, assigned, tracked, remediated, and eventually retested. In many organizations, each of those steps happens in a different system and depends on a manual handoff. Testers work in one set of tools. Reports are assembled in Word or spreadsheets. Findings are delivered through PDFs. Security teams recreate them in ticketing systems. Engineering teams update remediation status somewhere else. Retesting is coordinated through email or meetings. By the time the right owner receives the information needed to act, days or weeks may have passed. At PlexTrac , we see this as one of the largest operational gaps in modern offensive security: organizations have invested in finding vulnerabilities, but the process surrounding the pentest has not kept pace. The next phase of pentest modernization is removin...

We had an enterprise customer tell us their entire AI footprint was Copilot. That was the whole answer. One tool, one line item, done. We ran the first scan. Copilot wasn't even close to number one. Claude was. OpenAI came in second. Copilot was third. Nobody on the security team knew because Claude doesn't show up the way a SaaS app used to show up. There's no single login screen, no single admin console, no one place to look. That's the part most security teams miss. Claude isn't one surface. It's six. The six places Claude actually runs Claude Enterprise and Connected Apps. This is the surface everyone pictures: employees typing into Claude, OAuth'd into Google Drive, GitHub, Slack, and Jira, asking Claude to act on what's inside. The audit log shows that a connection happened. It does not show what got pulled into the prompt or what came back out. A finance analyst can drop a quarter of board materials into a conversation in ten second...

Security is fundamentally about knowing what a system is supposed to do, then catching it when it does something else. For software with deterministic execution paths, that is a tractable problem. For AI agents, it is not. An agent does not follow a fixed code path. It reasons toward a goal, selects tools based on that reasoning, and adapts its next action based on what those tools return. The same input can produce a different sequence of actions depending on context, session history, and what an external tool happened to return. Behavior is the attack surface, and behavior changes. Traditional proxies and AI firewalls were built to inspect content: what a user sent, what a model returned. Intent security asks a different question: is this agent doing what it was built to do, in this context, for this user, right now? Answering that requires building a behavioral baseline for every agent and measuring deviation from it continuously. That is the problem Lasso was built to solve....

Attackers prefer the path of least resistance. Why break in when you can log in? That is what makes working credentials so valuable. A leaked password, token, or API key does more than reveal sensitive data; it offers a way in. No vulnerability or privilege escalation chain necessary. If the credential is valid, the attacker can simply use it, and the session will look like ordinary activity. This shifts the questions from "where can attackers break in?" to "where do usable keys tend to accumulate? Increasingly, the answer is the developer laptop: one of the most instrumented machines most companies own, and one of the easiest places for credentials to go unnoticed. The endpoint is watched for malware, behavior, posture, and configuration. But a valid plaintext credential is something else: a door an attacker may not need to force. A fully patched fleet can still have usable keys scattered across its devices, enough to turn one foothold into something much larger....

Why Authentication Context Matters Most people think logging in is a small act. Type your password, type your code, tap a screen, scan a face, and move on. But to the systems on the other side, the method behind that moment can matter just as much as the fact that it happened at all. That is where two strangely named but surprisingly important identity concepts enter the story: OIDC's AMR and SAML 2.0's AuthnContext. They sound like the kind of acronyms that only standards committees could love, yet both were created to answer a deeply human question in digital form: How sure a system has to be before it trusts someone? The backstory starts with the internet growing up. Early online services often treated authentication as a light switch: either the user was in, or the user was out. But as online systems began handling payroll, health records, taxes, academic data, contracts, and financial approvals, that simple model started to crack. A login backed by a reused password is not ...

Most application security (AppSec) teams know their OWASP Top 10, the industry-standard list of the most critical software security risks. Fewer know which of those categories their organization actually fixes. In conversations with security teams, I hear the same story: "We prioritize criticals, so the important stuff gets handled." The data tells a different story. Fix rates vary dramatically by OWASP vulnerability class, and not in the ways most teams expect. The data comes from Semgrep's Remediation at Scale report , which analyzed anonymized remediation patterns across 50,000+ repositories and hundreds of organizations during 2025. The methodology is straightforward: group organizations into two cohorts by fix rate (top 15% as "leaders," remaining 85% as "field"), then compare what each group actually does differently. The gap between leaders and the field isn't about detection quality or prioritization frameworks. Both cohorts apply the s...

While AI reduces some coding flaws, credential sprawl accelerates, expanding the non-human identity attack surface, and making remediation the new security bottleneck. AI is changing software development faster than most security teams can adapt. As coding assistants and autonomous agents become embedded in daily workflows, many assume traditional application security controls will steadily lose relevance. If machines can scan code, catch flaws, and even suggest safer alternatives in real time, then software risk should start to shrink. But that's not what is happening in the real world, according to GitGuardian's security research. The battle isn't in the code anymore, because AI is shifting where the control point is. It's in the credentials, tokens, service accounts, and machine identities that AI systems need in order to access data and take action. This matters because the attack surface has fundamentally changed. AI-assisted commits grew exponentially in 2025 and leaked secr...