Blog

Research, write-ups, tutorials.

How AppSec changes when agents write the code. Logic flaws, MCP, agent-time security. New every week.

What Is Slopsquatting? The New HalluSquatting Attack on AI Coding Agents

Slopsquatting explained: how AI coding agents hallucinate package names attackers pre-register, why typosquatting defenses miss them, and the 2026 HalluSquatting botnet attack.

Jul 10, 202617 min readRead article

What Is Slopsquatting? The New HalluSquatting Attack on AI Coding Agents

All posts

21 articles

SecurityJun 25, 2026

Can an AI Agent Find AND Fix Vulnerabilities, and Open the PR?

Yes, with the right setup. How AI vulnerability auto-remediation works, why single-scanner autofix is shallow, whether you can trust an AI-generated fix, and how the find, fix, verify and open-a-PR loop runs.

CYBEDEFEND11 min read

SecurityJun 25, 2026

The Best AI Code Security Tools in 2026: A Buyer's Guide

AI writes the code now, which changes what a security tool has to do. The criteria that matter for AI-generated code, how to choose, and an honest look at the field: CybeDefend, Snyk, Checkmarx, Aikido, Semgrep, Endor Labs, GitGuardian.

CYBEDEFEND10 min read

SecurityJun 25, 2026

Is AI-Generated Code Safe? What the 2026 Data Says, and What Scanners Miss

Short answer: AI-generated code runs, but a large share is insecure. The 2026 data, the vulnerability classes scanners and the LLMs themselves miss, and how to make AI code safe to ship.

CYBEDEFEND11 min read

SecurityJun 25, 2026

How to Add Security to Your AI Coding Workflow (Without Slowing It Down)

A practical playbook for eng leaders: the four control points that secure an AI coding workflow, from rules in the agent to guards on dangerous actions to autofix in the PR, without slowing developers down.

CYBEDEFEND10 min read

SecurityJun 23, 2026

AI Vulnerability Remediation: Giving Coding Agents Live Access to Every Finding

Your scanners already found the vulnerabilities. AI vulnerability remediation gives the coding agent live access to every SAST, SCA, IaC, secret and CI/CD finding, so it triages and fixes them in the loop.

CYBEDEFEND14 min read

SecurityJun 23, 2026

How to Secure a Whole Application in 5 Minutes With Your AI Agent

The real, step-by-step flow: create a CybeDefend account, connect your repo for the first scan, install VibeDefend in your AI agent with one CLI command, then prompt it to triage and fix the findings.

CYBEDEFEND11 min read

SecurityJun 16, 2026

AI Coding Agent Security: The Agent-Time Model

AI coding agents write, run and ship code at machine speed. Why post-PR scanning fails, what agent-time security means, and how to secure Claude Code, Cursor, Copilot, Windsurf and Codex.

CYBEDEFEND15 min read

ResearchJun 16, 2026

Business Logic Flaws in AI-Generated Code: Why Your Scanner Is Blind

SAST finds injection; it cannot see broken authorization, missing tenant scoping or a negative-quantity cart. Why AI agents ship business logic flaws, and how to catch them at agent-time.

CYBEDEFEND14 min read

SecurityJun 16, 2026

MCP Security: Tool Poisoning, Prompt Injection, and How to Lock Down Agent Tools

The Model Context Protocol gives AI agents real tools, and a real attack surface: tool poisoning, rug pulls, prompt injection. How the attacks work and how to block them at agent-time.

CYBEDEFEND19 min read

SecurityJun 16, 2026

Vibe Coding Security: The Risks You Ship With, and How to Catch Them

Vibe coding ships features fast and vulnerabilities faster: hardcoded secrets, broken auth, injection, no input validation. The real risk classes by CWE, and how to secure vibe coding at agent-time.

CYBEDEFEND18 min read

SecurityJun 16, 2026

Windsurf Security: Risks, Controls, and Best Practices

Windsurf's Cascade agent edits files, runs commands and calls MCP tools. The real security risks, what the built-in controls cover, and how to secure Windsurf.

CYBEDEFEND24 min read

SecurityJun 10, 2026

Claude Code Security: Risks, Controls, and Best Practices

Claude Code reads your repo, runs shell commands and calls MCP tools. The real security risks, what built-in controls cover, and how to secure it.

CYBEDEFEND21 min read

SecurityJun 10, 2026

Cursor Security: Risks, Controls, and Best Practices

Cursor reads your repo, runs tasks and generates code fast. Here are the real Cursor security risks, what built-in controls cover, and why they fall short.

CYBEDEFEND22 min read

ReleaseJun 10, 2026

Rust SAST is mostly theatre. We just shipped the real one.

Most Rust SAST is pattern matching: false positives plus missed bugs. Here is why dataflow analysis catches the SQL injection, XSS and SSRF it cannot.

CYBEDEFEND9 min read

SecurityJun 10, 2026

GitHub Copilot Security: Risks, Controls, and Best Practices

GitHub Copilot security explained: where its content exclusions, secret scanning and IP indemnity help, the real risks they miss, and how to close the gap.

CYBEDEFEND23 min read

SecurityJun 10, 2026

OpenAI Codex Security: Risks, Controls, and Best Practices

OpenAI Codex security explained: what its sandbox and approval modes cover, the top risks from command injection to supply chain, and how to govern it.

CYBEDEFEND23 min read

ProductMay 26, 2026

VibeDefend Just Shipped. Your AI Agent Has New Rules, Installed in 5 Seconds.

One npx line wires Claude Code, Cursor, Codex, Windsurf and VS Code Copilot into your governance layer: business rules, OWASP, SOC 2 and GDPR, action guards.

CYBEDEFEND11 min read

ResearchApr 28, 2026

Why your scanner reports 1,200 vulnerabilities and only 12 are real

Open any SAST report and you see hundreds of red flags. A field guide to reachability, exploitability and business logic, and why scanners confuse them.

CYBEDEFEND9 min read

ResearchApr 15, 2026

The $0 Shopping Cart: Why Your "All-Green" SAST Report Is Lying To You

Their CI/CD was perfect. Snyk ran, Dependabot watched, every indicator was green. Ten minutes into the audit, I bought their entire inventory for 0 euros.

CYBEDEFEND5 min read

ResearchApr 8, 2026

The Evolution of Secure by Design in the AI Era

AI is redefining Secure by Design, turning static security into proactive defense. See how AI agents predict and prevent threats before they happen.

CYBEDEFEND7 min read

Live · just shipped

Install VibeDefend in 5 seconds.

One command wires every coding agent on your machine to CybeDefend: your business rules, your compliance frameworks, and guards that block destructive calls before they fire.

Install in 5 secondsNode 18.17+

npx -y @cybedefend/vibedefend@latest install

Auto-detects

Claude Code
Cursor
OpenAI Codex
Windsurf
VS Code Copilot

Read the README on npm