» Tag
devsecops
19 postsWhen AI Reviewers Disagree: A Multi-Agent Code Review Tribunal
ShiftLeft Society pits two AI reviewers against each other in a cost-based negotiation, using Qwen-Max to cut false positives and raise accuracy from 82.5% to 95%.
Synapse Lets AI Flag False Positives, Never Delete Findings
Synapse's two-model AI triage flags false positives in security scans without deleting findings, preserving gate reliability and audit trails.
NVIDIA Outlines Four Controls for Securing AI Agents
NVIDIA's AI Red Team details four common failure modes in AI agent deployments and the access, execution, network, and secrets controls that stop them.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comAgenthound: Offensive Security Framework for AI Agent Infrastructure
Agenthound is an open-source offensive security framework mapping attack paths across MCP, A2A, and AI model infrastructure via a Neo4j graph.
Securing MCP Servers: Four Gates From Code to Production
A leaked .env file exposed a design flaw in an MCP server. Here's a four-gate, OWASP-aligned defense strategy engineers can adopt today.
Epistemic Engine verifies AI code and predicts what will break
Epistemic Engine is an open-source Python tool that verifies AI-generated code and forecasts future failures using deterministic git-history analysis.
8 security layers for an MCP marketplace: what each one catches
A developer built 8 defense-in-depth security layers for an MCP marketplace after a trojan slipped through — here's what each layer actually catches.
GitHub Copilot Now Catches Vulnerabilities Before You Commit
GitHub Copilot's new slash command scans uncommitted code for OWASP vulnerabilities like injection and XSS before it ever reaches your repo.
Study Finds 38.9% of AI Coding Agent PRs Contain Security Smells
Large-scale study of AI coding agent PRs finds 38.9% contain security smells, with most leaked credentials introduced by human developers, not AI.
Sophos study: AI coding agents look like attackers to a SIEM
Sophos telemetry shows Claude Code, Cursor, and Codex trigger SIEM alerts for credential access and evasion during normal, benign operation.