CybeDefend
Blog

Research, write-ups, tutorials.

How AppSec changes when agents write the code. Logic flaws, MCP, agent-time security. New every week.

Install freeTalk to us
Latest postResearch

Nobody Is Reviewing Your Agent's Pull Requests

A human alone reviews an agent's pull request 8% of the time. What the UK AI Security Institute incident means for your review process.

20 min readRead article
Nobody Is Reviewing Your Agent's Pull Requests

All posts

26 articles
The 12 Best AI Security Platforms for Vulnerability Detection, and the One Question That Now Separates Them
Research

The 12 Best AI Security Platforms for Vulnerability Detection, and the One Question That Now Separates Them

Twelve platforms scored on what they detect, what survives triage and where the verdict lands, with each vendor's positioning as it stands today.

CybeDefendCYBEDEFEND18 min read
Read more
Your Model Got Smarter. Your Code Did Not Get Safer.
Research

Your Model Got Smarter. Your Code Did Not Get Safer.

Capability doubled in one model generation while security stayed flat. Why upgrading the model and telling it to be secure both fail under measurement.

CybeDefendCYBEDEFEND18 min read
Read more
Instruction File Injection: How AGENTS.md and CLAUDE.md Hijack Coding Agents
Security

Instruction File Injection: How AGENTS.md and CLAUDE.md Hijack Coding Agents

AGENTS.md and CLAUDE.md load with near system-prompt authority. How instruction file injection works, the named 2026 incidents, and how to defend your repo.

CybeDefendCYBEDEFEND21 min read
Read more
What Is an AI-BOM? The AI Bill of Materials the EU AI Act Assumes You Already Have
Compliance

What Is an AI-BOM? The AI Bill of Materials the EU AI Act Assumes You Already Have

What an AI-BOM contains, how it maps to EU AI Act Article 11 and Annex IV, and why an inventory kept as a document is stale before it is signed.

CybeDefendCYBEDEFEND26 min read
Read more
What Is Slopsquatting? The New HalluSquatting Attack on AI Coding Agents
Security

What Is Slopsquatting? The New HalluSquatting Attack on AI Coding Agents

How AI coding agents hallucinate package names that attackers pre-register, why typosquatting defenses miss them, and the 2026 HalluSquatting botnet.

CybeDefendCYBEDEFEND17 min read
Read more
Can an AI Agent Find AND Fix Vulnerabilities, and Open the PR?
Security

Can an AI Agent Find AND Fix Vulnerabilities, and Open the PR?

How AI vulnerability auto-remediation works, why single-scanner autofix is shallow, and how the find, fix, verify and open-a-PR loop runs.

CybeDefendCYBEDEFEND11 min read
Read more
The Best AI Code Security Tools in 2026: A Buyer's Guide
Security

The Best AI Code Security Tools in 2026: A Buyer's Guide

The criteria that matter for AI-generated code, how to choose, and an honest look at CybeDefend, Snyk, Checkmarx, Aikido, Semgrep and Endor Labs.

CybeDefendCYBEDEFEND10 min read
Read more
Is AI-Generated Code Safe? What the 2026 Data Says, and What Scanners Miss
Security

Is AI-Generated Code Safe? What the 2026 Data Says, and What Scanners Miss

AI-generated code runs, but a large share is insecure. The 2026 data, the classes scanners and LLMs both miss, and how to make it safe to ship.

CybeDefendCYBEDEFEND11 min read
Read more
How to Add Security to Your AI Coding Workflow (Without Slowing It Down)
Security

How to Add Security to Your AI Coding Workflow (Without Slowing It Down)

The four control points that secure an AI coding workflow, from rules in the agent to guards on dangerous actions, without slowing developers down.

CybeDefendCYBEDEFEND10 min read
Read more
AI Vulnerability Remediation: Giving Coding Agents Live Access to Every Finding
Security

AI Vulnerability Remediation: Giving Coding Agents Live Access to Every Finding

AI vulnerability remediation gives the coding agent live access to every SAST, SCA, IaC, secret and CI/CD finding, so it triages and fixes in the loop.

CybeDefendCYBEDEFEND14 min read
Read more
How to Secure a Whole Application in 5 Minutes With Your AI Agent
Security

How to Secure a Whole Application in 5 Minutes With Your AI Agent

Step by step: create the account, connect your repo for the first scan, install VibeDefend with one CLI command, then let the agent fix the findings.

CybeDefendCYBEDEFEND11 min read
Read more
AI Coding Agent Security: The Agent-Time Model
Security

AI Coding Agent Security: The Agent-Time Model

Why post-PR scanning fails against agents that write and ship at machine speed, what agent-time security means, and how to secure the five big agents.

CybeDefendCYBEDEFEND15 min read
Read more
Business Logic Flaws in AI-Generated Code: Why Your Scanner Is Blind
Research

Business Logic Flaws in AI-Generated Code: Why Your Scanner Is Blind

SAST finds injection; it cannot see broken authorization, missing tenant scoping or a negative-quantity cart. How to catch those at agent-time.

CybeDefendCYBEDEFEND14 min read
Read more
MCP Security: Tool Poisoning, Prompt Injection, and How to Lock Down Agent Tools
Security

MCP Security: Tool Poisoning, Prompt Injection, and How to Lock Down Agent Tools

MCP gives AI agents real tools and a real attack surface: tool poisoning, rug pulls, prompt injection. How the attacks work and how to block them.

CybeDefendCYBEDEFEND19 min read
Read more
Vibe Coding Security: The Risks You Ship With, and How to Catch Them
Security

Vibe Coding Security: The Risks You Ship With, and How to Catch Them

Vibe coding ships features fast and vulnerabilities faster: hardcoded secrets, broken auth, injection. The real risk classes by CWE, and the fix.

CybeDefendCYBEDEFEND18 min read
Read more
Windsurf Security: Risks, Controls, and Best Practices
Security

Windsurf Security: Risks, Controls, and Best Practices

Windsurf's Cascade agent edits files, runs commands and calls MCP tools. The real security risks, what the built-in controls cover, and how to secure Windsurf.

CybeDefendCYBEDEFEND24 min read
Read more
Claude Code Security: Risks, Controls, and Best Practices
Security

Claude Code Security: Risks, Controls, and Best Practices

Claude Code reads your repo, runs shell commands and calls MCP tools. The real security risks, what built-in controls cover, and how to secure it.

CybeDefendCYBEDEFEND21 min read
Read more
Cursor Security: Risks, Controls, and Best Practices
Security

Cursor Security: Risks, Controls, and Best Practices

Cursor reads your repo, runs tasks and generates code fast. Here are the real Cursor security risks, what built-in controls cover, and why they fall short.

CybeDefendCYBEDEFEND22 min read
Read more
Rust SAST is mostly theatre. We just shipped the real one.
Release

Rust SAST is mostly theatre. We just shipped the real one.

Most Rust SAST is pattern matching: false positives plus missed bugs. Here is why dataflow analysis catches the SQL injection, XSS and SSRF it cannot.

CybeDefendCYBEDEFEND9 min read
Read more
GitHub Copilot Security: Risks, Controls, and Best Practices
Security

GitHub Copilot Security: Risks, Controls, and Best Practices

GitHub Copilot security explained: where its content exclusions, secret scanning and IP indemnity help, the real risks they miss, and how to close the gap.

CybeDefendCYBEDEFEND23 min read
Read more
OpenAI Codex Security: Risks, Controls, and Best Practices
Security

OpenAI Codex Security: Risks, Controls, and Best Practices

OpenAI Codex security explained: what its sandbox and approval modes cover, the top risks from command injection to supply chain, and how to govern it.

CybeDefendCYBEDEFEND23 min read
Read more
VibeDefend Just Shipped. Your AI Agent Has New Rules, Installed in 5 Seconds.
Product

VibeDefend Just Shipped. Your AI Agent Has New Rules, Installed in 5 Seconds.

One npx line wires Claude Code, Cursor, Codex, Windsurf and VS Code Copilot into your governance layer: business rules, OWASP, SOC 2 and GDPR, action guards.

CybeDefendCYBEDEFEND11 min read
Read more
Why your scanner reports 1,200 vulnerabilities and only 12 are real
Research

Why your scanner reports 1,200 vulnerabilities and only 12 are real

Open any SAST report and you see hundreds of red flags. A field guide to reachability, exploitability and business logic, and why scanners confuse them.

CybeDefendCYBEDEFEND9 min read
Read more
The $0 Shopping Cart: Why Your "All-Green" SAST Report Is Lying To You
Research

The $0 Shopping Cart: Why Your "All-Green" SAST Report Is Lying To You

Their CI/CD was perfect. Snyk ran, Dependabot watched, every indicator was green. Ten minutes into the audit, I bought their entire inventory for 0 euros.

CybeDefendCYBEDEFEND5 min read
Read more
The Evolution of Secure by Design in the AI Era
Research

The Evolution of Secure by Design in the AI Era

AI is redefining Secure by Design, turning static security into proactive defense. See how AI agents predict and prevent threats before they happen.

CybeDefendCYBEDEFEND7 min read
Read more
Live · just shipped

Install VibeDefend in 5 seconds.

One command wires every coding agent on your machine to CybeDefend: your business rules, your compliance frameworks, and guards that block destructive calls before they fire.

Install in 5 secondsNode 18.17+
npx -y @cybedefend/vibedefend@latest install
Auto-detects
  • Claude CodeClaude Code
  • CursorCursor
  • OpenAI CodexOpenAI Codex
  • WindsurfWindsurf
  • GitHub CopilotVS Code Copilot
Read the README on npm