# snyk-code Published articles for snyk-code. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Is prevention essentially a solved problem? DevFeed: [Is prevention essentially a solved problem?]() Original publisher: [Read original article]() Author: Ezra Tanzer Published: 2026-09-10T04:00:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [AI Development](), [Vulnerabilities](), [Architecture & Design](), [Code]() Tags: [agent](), [agentic](), [ai](), [application-security](), [awareness](), [blog](), [code](), [code-security](), [cost](), [developer](), [devops](), [devsecops](), [secrets](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [vulnerabilities](), [vulnerability-insights]() ### AI overview The article argues that preventing vulnerabilities in agent-generated code is architecturally understood, but organizations must apply the appropriate controls throughout a changing development lifecycle. It says prompts can influence code but cannot reliably constrain agents, and that earlier security intervention reduces model-token cost, human attention, and the risk of an incorrect fix. ### Source excerpt Prevention in agent-generated code is architecturally solved--but choosing controls that protect security without slowing development remains the challenge. ## Remediation Agents, Demystified: Why Fixing Beats Finding DevFeed: [Remediation Agents, Demystified: Why Fixing Beats Finding]() Original publisher: [Read original article]() Author: Snyk Team Published: 2026-08-19T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [Vulnerabilities](), [AI-assisted coding](), [pull-requests](), [Responsibility & Safety](), [Artificial Intelligence]() Tags: [agentic](), [ai](), [ai-agents](), [application-security](), [aspm](), [awareness](), [ci-cd](), [code-security](), [community](), [developer](), [devops](), [devsecops](), [enablement](), [interest](), [javascript](), [live-stream](), [node-js](), [pull-requests](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [validation](), [vs-code](), [vulnerabilities]() ### AI overview Snyk's Remediation Agent is presented as a public-preview solution for the growing security-issue backlog. The article explains how coding agents can increase vulnerabilities, why deterministic remediation advice has not been enough, and how validation helps turn fixes into mergeable pull requests. ### Source excerpt See how Snyk's Remediation Agent uses security intelligence, breakability analysis, and validation to turn vulnerabilities into mergeable pull requests. ## Benchmarking Secure-and-Functional Remediation and How Snyk Agent Fix Lifts Frontier-Model Fix Rates by over 14% DevFeed: [Benchmarking Secure-and-Functional Remediation and How Snyk Agent Fix Lifts Frontier-Model Fix Rates by over 14%]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2026-08-18T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [benchmarking](), [LLM evaluation / benchmarking](), [vulnerability](), [AI-assisted coding](), [JavaScript](), [Python]() Tags: [agentic](), [ai](), [awareness](), [benchmark](), [benchmarking](), [benchmarks](), [blog](), [code-security](), [developer](), [devops](), [evaluation](), [interest](), [java](), [javascript](), [performance](), [python](), [security](), [security-labs](), [snyk-code](), [snyk-security-intel](), [vulnerability](), [vulnerability-insights]() ### AI overview A benchmark of about 150 vulnerable JavaScript, Java, and Python samples evaluates whether frontier models produce fixes that are both secure and functional. The article reports that models working alone reach roughly 72-75%, while Snyk Intelligence raises Opus 4.6 from 74.6% to 85.4% and improves Python results from 64% to 88%. ### Source excerpt A benchmark of secure, functional vulnerability fixes across JavaScript, Java, and Python shows Snyk Intelligence helps frontier models break past a 72-75% performance plateau. ## A First Look at Evo Agentic AppSec: Agentic Remediation and Malicious Code Defense DevFeed: [A First Look at Evo Agentic AppSec: Agentic Remediation and Malicious Code Defense]() Original publisher: [Read original article]() Author: Brendan Hann Published: 2026-08-04T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [AI Bots]() Tags: [agent](), [agentic](), [ai](), [ai-agents](), [ai-security](), [application-security](), [aspm](), [autonomous](), [blog](), [cli](), [code-security](), [developer](), [devops](), [interest](), [javascript](), [node-js](), [open-source-security](), [pull-request](), [python](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [vulnerabilities](), [vulnerability-insights]() ### AI overview Snyk introduces Evo Agentic AppSec capabilities for automatically remediating vulnerabilities and blocking malicious packages before they reach code. The Remediation Agent triages issues, creates and checks fixes, and opens pull requests for review. ### Source excerpt Explore Snyk's first Agentic AppSec capabilities: an autonomous Remediation Agent that fixes vulnerabilities and Malicious Code Defense that blocks risky packages before they ship. ## Secure at Inception: Announcing the Snyk Studio Integration for Snowflake Cortex Code DevFeed: [Secure at Inception: Announcing the Snyk Studio Integration for Snowflake Cortex Code]() Original publisher: [Read original article]() Author: Snyk Team Published: 2026-07-30T00:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [AI Bots]() Tags: [ai](), [ai-agent](), [application-security](), [article](), [cloud-security](), [code](), [code-security](), [containers](), [developer](), [devops](), [devsecops](), [enablement](), [finserv](), [health-care](), [integration](), [python](), [security](), [snyk-code](), [snyk-container](), [snyk-open-source](), [snyk-platform](), [supply-chain-security](), [vulnerabilities]() ### AI overview Snyk Studio is integrated with Snowflake Cortex Code to scan AI-generated application code, dependencies, and container images for vulnerabilities during development. ### Source excerpt Snyk Studio integrates with Snowflake Cortex Code to scan AI-generated code, dependencies, and containers for vulnerabilities during development. ## The Attacker Never Sleeps, Neither Can Your Testing DevFeed: [The Attacker Never Sleeps, Neither Can Your Testing]() Original publisher: [Read original article]() Author: Manoj Nair Published: 2026-07-30T00:00:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [AI-assisted coding](), [Developer Tools]() Tags: [agents](), [ai](), [application-security](), [awareness](), [blog](), [code](), [code-security](), [devops](), [devsecops](), [executive](), [finserv](), [interest](), [open-source-security](), [security](), [snyk-apprisk](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [software](), [supply-chain-security](), [tech](), [testing](), [vulnerability-insights]() ### AI overview AI-driven code generation is expanding software attack surfaces while giving attackers machine-speed reasoning capabilities. The article argues that security teams need continuous testing, agent governance, and independent validation of findings. ### Source excerpt AI is accelerating software development and giving attackers machine-speed capabilities. Security teams must continuously test AI-built code, govern agents, and independently validate every finding. ## Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice? DevFeed: [Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?]() Original publisher: [Read original article]() Author: Liran Tal Published: 2026-06-29T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [Vulnerabilities](), [AI-assisted coding]() Tags: [agentic](), [ai](), [application-security](), [awareness](), [benchmark](), [blog](), [claude](), [code-security](), [developer](), [devops](), [engineering](), [interest](), [llms](), [node-js](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [vulnerability](), [vulnerability-insights]() ### AI overview Snyk VulnBench JS 1.0 evaluates how consistently agentic LLM security reviews find vulnerabilities across identical repeated scans. Reference-matched findings were comparatively stable, while LLM-only reports varied substantially; the article argues for combining LLM review with deterministic SAST rather than replacing either approach. ### Source excerpt Snyk VulnBench JS 1.0: 300 repeated scans show LLM security findings vary by run, while SAST and models catch different vulnerability gaps. ## What nearly 10,000 developer environments reveal about agentic development risk DevFeed: [What nearly 10,000 developer environments reveal about agentic development risk]() Original publisher: [Read original article]() Author: Ricardo Miguel Silva Published: 2026-06-23T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [AI-assisted coding](), [supply-chain-security](), [Application Security](), [Model Context Protocol](), [Agent Skills](), [prompt injection](), [Security](), [software-development](), [Tooling]() Tags: [agentic](), [agents](), [ai](), [ai-coding](), [application-security](), [article](), [awareness](), [claude](), [code](), [cursor](), [developer](), [developers](), [development](), [devops](), [devsecops](), [enablement](), [interest](), [prompt-injection](), [secrets](), [security](), [security-labs](), [skills](), [snyk-code](), [snyk-platform](), [snyk-security-intel](), [software-development](), [supply-chain](), [supply-chain-security](), [systems](), [tool](), [tooling](), [tools](), [vs-code]() ### AI overview Snyk analyzed nearly 10,000 developer environments and found that agentic development is introducing a new software supply chain layer. The article reports widespread use of multiple AI coding environments, MCP servers, and agent skills, along with confirmed prompt injection findings and security exposure that AppSec teams need to govern. ### Source excerpt AI coding agents are adding a new layer to the software supply chain. Learn what Snyk found in nearly 10,000 developer environments and how to secure the tools, instructions, and permissions behind agentic development. ## The full Snyk AI Security Platform, free for open source maintainers DevFeed: [The full Snyk AI Security Platform, free for open source maintainers]() Original publisher: [Read original article]() Author: Brendan Hann Published: 2026-06-18T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Maintainers](), [Open Source](), [Security](), [vulnerability](), [open-source-security](), [Artificial Intelligence](), [Frontier Model](), [Remote Access Trojan](), [AI Infrastructure]() Tags: [agent](), [ai](), [ai-infrastructure](), [ai-security](), [article](), [awareness](), [bugs](), [developer](), [enablement](), [engineering](), [frontier-model](), [interest](), [maintainers](), [open-source](), [open-source-security](), [remote-access-trojan](), [security](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [snyk-team](), [software](), [supply-chain-security](), [vulnerability](), [vulnerability-insights]() ### AI overview Snyk's Secure Developer Program gives qualifying open source projects free access to the Snyk AI Security Platform. It is designed to help maintainers prioritize real vulnerability reports and produce validated, merge-ready fixes through the Snyk Remediation Agent. ### Source excerpt Open source maintainers are drowning in real vulnerability reports and need help prioritizing, fixing, and shipping remediation faster. Snyk's Secure Developer Program gives qualifying projects free access to the Snyk AI Security Platform. ## When a Government Pulls an AI Model: What the Fable 5 and Mythos 5 Suspension Means for Security Teams DevFeed: [When a Government Pulls an AI Model: What the Fable 5 and Mythos 5 Suspension Means for Security Teams]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2026-06-14T13:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Artificial Intelligence](), [Security](), [anthropic](), [Claude](), [Frontier Model](), [Jailbreak](), [Code]() Tags: [ai](), [anthropic](), [application-security](), [awareness](), [blog](), [claude](), [code](), [code-security](), [developer](), [devrel](), [frontier-model](), [jailbreak](), [policy](), [security](), [snyk-code](), [us]() ### AI overview The article examines Anthropic's worldwide suspension of Claude Fable 5 and Mythos 5 after a US export-control directive concerning foreign-national access and a reported narrow jailbreak involving code analysis. It discusses the distinction between the directive's scope and the blanket shutdown, and considers the implications for security teams that depend on external frontier models. ### Source excerpt On June 12, 2026, a US export-control directive led Anthropic to disable Claude Fable 5 and Mythos 5 worldwide over a reported jailbreak. The reported trigger was a code-analysis capability that defenders use routinely. Here is what happened, how the security community read it, and what security teams can take from it. ## Type Level Security: The future of secure AI code generation? DevFeed: [Type Level Security: The future of secure AI code generation?]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2026-06-04T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [AI-assisted coding](), [Vulnerabilities](), [Rust](), [Python](), [Web](), [Document Object Model (DOM)](), [Application Services]() Tags: [ai](), [application-security](), [awareness](), [blog](), [code-generation](), [code-security](), [developer](), [devops](), [devsecops](), [enablement](), [external](), [opa](), [python](), [rust](), [security](), [snyk-code](), [snyk-platform](), [tools](), [types](), [vulnerabilities](), [web]() ### AI overview The article argues that type systems and secure-by-design libraries can make many web application security vulnerabilities impossible to write or catch at compile time. It presents this approach as a way to reduce vulnerabilities in manually written and AI-generated code, with examples involving Rust, Python, and Trusted Types. ### Source excerpt Secure-by-design types can turn common bugs into compile-time errors. This post explores how type-level security could help prevent entire classes of AI-generated vulnerabilities. ## The New Security Risks of the Agentic Development Lifecycle DevFeed: [The New Security Risks of the Agentic Development Lifecycle]() Original publisher: [Read original article]() Author: Daniel Berman Published: 2026-06-03T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Application Security](), [sdlc](), [Artificial Intelligence](), [Code]() Tags: [agentic](), [agents](), [ai](), [ai-agents](), [application-security](), [autonomous](), [awareness](), [blog](), [ci-cd](), [code](), [developer](), [development](), [devops](), [devsecops](), [enablement](), [interest](), [scm](), [sdlc](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [software](), [tech](), [workflows]() ### AI overview The article explains the agentic development lifecycle, in which AI agents plan, build, modify, test, and ship software by interacting with tools, codebases, data sources, and development environments. It argues that security must protect the process creating software as well as the resulting code, because agents can introduce risk through what they use, do, and generate. ### Source excerpt AI agents are changing how software gets built, and with it, where security risk begins. Learn why securing the process matters as much as securing the code. ## Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection DevFeed: [Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection]() Original publisher: [Read original article]() Author: Brian Vermeer Published: 2026-06-02T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [prompt injection](), [agentic-coding](), [AI-assisted coding](), [Open Source](), [Command-line interface](), [Maven](), [CI/CD](), [payload](), [Claude Code](), [cursor](), [GitHub Copilot]() Tags: [agentic-coding](), [agents](), [ai](), [ai-agents](), [ai-coding](), [article](), [awareness](), [ci-cd](), [claude-code](), [code](), [copilot](), [cursor](), [developer](), [devops](), [github](), [interest](), [java](), [open-source](), [open-source-security](), [payload](), [prompt-injection](), [sandbox](), [scm](), [security](), [security-labs](), [snyk-code](), [snyk-open-source](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [testing](), [tools](), [vulnerability-insights]() ### AI overview The article examines jqwik 1.10.0, whose maintainer embedded a prompt injection in test output aimed at AI coding agents. ANSI terminal escape codes concealed the instruction from humans while leaving it visible to tools processing raw logs, creating a supply-chain risk for CI/CD pipelines and agentic coding workflows. ### Source excerpt jqwik 1.10.0 added a hidden prompt injection aimed at AI coding agents, using terminal escape codes to conceal destructive instructions from humans while leaving them readable to logs and tools. ## Introducing the New Agentic Architecture for Snyk Agent Fix: Faster, Smarter, and More Secure DevFeed: [Introducing the New Agentic Architecture for Snyk Agent Fix: Faster, Smarter, and More Secure]() Original publisher: [Read original article]() Author: Brendan Hann; David Alessi Published: 2026-04-27T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk-code](), [Artificial Intelligence](), [Code](), [Large Language Model](), [LLM evaluation / benchmarking](), [benchmarking](), [Architecture & Design](), [Security](), [Vulnerabilities](), [Fine-tuning]() Tags: [agentic](), [ai](), [application-security](), [architecture](), [article](), [benchmarking](), [code](), [developer](), [enablement](), [engineering](), [evaluation](), [fine-tuning](), [interest](), [java](), [llm](), [python](), [security](), [snyk-code](), [snyk-team](), [vulnerabilities]() ### AI overview Snyk Agent Fix is being upgraded to an agentic architecture that uses dynamic few-shot prompting and Snyk's security intelligence to produce safer, more functional AI-powered code fixes. The article describes full Snyk Code language coverage and a three-tier benchmarking process covering security integrity, functional logic, and golden tests. ### Source excerpt Snyk Agent Fix upgrades to a new agentic architecture for faster, smarter, and more secure AI-powered code fixes. Now with full Snyk Code language coverage and verified remediation. ## Qinglong task scheduler RCE vulnerabilities exploited in the wild for cryptomining DevFeed: [Qinglong task scheduler RCE vulnerabilities exploited in the wild for cryptomining]() Original publisher: [Read original article]() Author: Julia Kinday Published: 2026-04-27T00:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [incident](), [Security](), [Express](), [GitHub Issues](), [Docker](), [GitHub](), [Open Source](), [Server](), [Shell](), [JavaScript](), [npm]() Tags: [application-security](), [attacks](), [auth](), [authentication](), [awareness](), [blog](), [ci-cd](), [cloud](), [cloud-security](), [code](), [developer](), [devops](), [docker](), [enablement](), [github](), [github-issues](), [incident](), [javascript](), [malware](), [node-js](), [open-source](), [open-source-security](), [routing](), [security](), [security-labs](), [self-hosted](), [servers](), [snyk-code](), [snyk-container](), [snyk-learn](), [snyk-open-source](), [snyk-security-intel](), [tech](), [typescript](), [vulnerabilities](), [vulnerability]() ### AI overview Qinglong, an open-source self-hosted task scheduling panel, was exploited through two authentication bypass vulnerabilities affecting versions 2.20.1 and earlier. Attackers used unauthenticated remote code execution to deploy cryptocurrency miners on publicly accessible installations. The article describes the vulnerabilities, their Express.js routing and middleware flaws, and the impact on operators using cloud VPS instances and home servers. ### Source excerpt Two authentication bypass vulnerabilities (CVE-2026-3965, CVE-2026-4047) in the Qinglong task scheduling panel were exploited in the wild to deploy cryptomining malware. Here's what happened, how the attacks worked, and what self-hosted application operators should learn from this incident. ## JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up? DevFeed: [JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up?]() Original publisher: [Read original article]() Author: John Carione Published: 2026-04-23T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Resilience](), [Security](), [snyk-iac](), [supply-chain-security](), [vulnerability](), [Infrastructure as code](), [Open Source](), [AI Development](), [releases](), [pull-requests](), [Code]() Tags: [ai](), [ai-development](), [awareness](), [blog](), [cloud-security](), [code](), [contentlab](), [developer](), [devops](), [executive](), [iac-security](), [interest](), [open-source](), [open-source-security](), [pull-requests](), [releases](), [resilience](), [sbom](), [secrets](), [security](), [snyk-cloud](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [snyk-security-intel](), [supply-chain-security](), [vulnerability]() ### AI overview JPMorganChase's 10-point cyber resilience checklist addresses enterprise security priorities spanning software versions, open-source dependencies, SBOMs, build pipelines, secrets, infrastructure as code, and AI development. The article explains how Snyk covers eight of the ten actions through developer workflows and its security platform. ### Source excerpt JPMorganChase published a 10-point cyber resilience checklist. See how Snyk covers 8 of the 10 actions and where it fits in your security stack. ## The 5 Principles of Snyk's Developer Experience DevFeed: [The 5 Principles of Snyk's Developer Experience]() Original publisher: [Read original article]() Author: Mayank Khera; Brendan Hann Published: 2026-03-26T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Developer experience](), [Security](), [developer tooling](), [Pull Request](), [Code review](), [Command-line interface](), [ide](), [CI/CD](), [Git](), [ai-coding](), [agent observability](), [internal developer portal]() Tags: [ai](), [ai-coding](), [americas](), [application-security](), [awareness](), [blog](), [ci-cd](), [cli](), [code-security](), [developer](), [developer-experience](), [developer-tooling](), [devops](), [devsecops](), [engineering](), [executive](), [git](), [ide](), [interest](), [pull-request](), [review](), [scm](), [security](), [snyk-code](), [snyk-platform](), [tech](), [vulnerability-insights]() ### AI overview Snyk presents five principles for developer experience, emphasizing seamless integration into existing workflows such as IDEs, terminals, Git, pull requests, AI coding assistants, and CI/CD. The article argues that surfacing security findings directly where developers work reduces context switching and helps teams ship secure code faster. ### Source excerpt Discover the 5 principles behind Snyk's developer experience. Learn how seamless workflows, actionable fixes, and AI-driven security help developers ship secure code faster without disrupting productivity. ## From Discovery to Defense: Why AI Red Teaming Is the Next Step After AI-SPM DevFeed: [From Discovery to Defense: Why AI Red Teaming Is the Next Step After AI-SPM]() Original publisher: [Read original article]() Author: Nuno Loureiro Published: 2026-03-25T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities]() Tags: [agentic](), [ai](), [analysis](), [attacks](), [authentication](), [awareness](), [blog](), [executive](), [interest](), [microservices](), [pmm](), [security](), [snyk-code](), [testing](), [vulnerabilities]() ### AI overview The article argues that AI red teaming should follow AI-SPM to test AI systems for prompt injection, data exposure, and behavioral vulnerabilities. It contrasts increasingly capable static code analysis with the need to test running, distributed applications where vulnerabilities can emerge across interacting components. ### Source excerpt AI red teaming is the next step after AI-SPM. Learn how Evo Agent Red Teaming simulates real attacks to uncover prompt injection, data exposure, and behavioral vulnerabilities in AI systems. ## Introducing Agent Security DevFeed: [Introducing Agent Security]() Original publisher: [Read original article]() Author: Manoj Nair Published: 2026-03-23T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [AI Agent](), [Securing AI](), [Artificial Intelligence](), [shadow AI](), [prompt injection](), [supply-chain-security](), [Security](), [data]() Tags: [agents](), [ai](), [ai-security](), [americas](), [application-security](), [applications](), [aspm](), [awareness](), [blog](), [ci-cd](), [code-security](), [compliance](), [developer](), [development](), [devsecops](), [executive](), [interest](), [pmm](), [production](), [prompt-injection](), [security](), [security-labs](), [shadow-ai](), [snyk-code](), [snyk-platform](), [supply-chain](), [supply-chain-security](), [tech]() ### AI overview Snyk introduces Agent Security, a unified approach to securing the AI agent lifecycle from code to runtime. The announcement presents Evo AI-SPM as a generally available foundation for inventorying, governing, and enforcing controls over AI models, agents, tools, and related risks, including shadow AI, prompt injection, data leakage, and unsafe agent actions. ### Source excerpt Introducing Agent Security, a unified approach to governing AI agents and ensuring safe behavior from code to runtime. Start with Evo AI-SPM, now generally available. ## The Next Era of AppSec: Why AI-Generated Code Needs Offensive Dynamic Testing DevFeed: [The Next Era of AppSec: Why AI-Generated Code Needs Offensive Dynamic Testing]() Original publisher: [Read original article]() Author: Nuno Loureiro Published: 2026-03-20T00:00:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [AI-assisted coding]() Tags: [agentic](), [ai](), [analysis](), [api](), [authentication](), [awareness](), [backend](), [blog](), [code](), [executive](), [interest](), [microservices](), [pmm](), [security](), [snyk-code](), [testing]() ### AI overview The article argues that AI-driven development has outpaced security validation. It says advanced static analysis can identify potential flaws, but offensive dynamic testing is needed to determine what is exploitable in live, distributed applications. ### Source excerpt Static analysis tells you what might be vulnerable, but dynamic testing tells you what is actually exploitable. Learn why the next era of AppSec requires combining code-level context with live environment testing to secure AI-generated code. ## I Read Cursor's Security Agent Prompts, So You Don't Have To DevFeed: [I Read Cursor's Security Agent Prompts, So You Don't Have To]() Original publisher: [Read original article]() Author: Randall Degges Published: 2026-03-17T04:00:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [cursor](), [Securing AI](), [ai security](), [Vulnerabilities](), [MCP Server](), [Orchestration](), [Prompt Engineering](), [Terraform](), [Persistence](), [Architecture & Design]() Tags: [agent](), [agentic](), [agents](), [ai](), [ai-security](), [application-security](), [automation](), [awareness](), [blog](), [ci-cd](), [cursor](), [developer](), [devops](), [executive](), [infrastructure](), [interest](), [mcp](), [mcp-server](), [orchestration](), [persistence](), [related-content](), [review](), [sbom](), [scm](), [secrel](), [secrets](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [terraform](), [vs-code](), [vulnerabilities]() ### AI overview The article examines Cursor's security review automation, which uses four autonomous agents to review more than 3,000 pull requests weekly, identify more than 200 vulnerabilities, and open fix pull requests. It argues that the concise prompts are only one part of the system; the larger achievement is the production infrastructure supporting persistence, deduplication, deployment, webhook orchestration, and state management. ### Source excerpt Cursor built AI security agents that review 3,000+ PRs weekly and catch 200+ vulnerabilities. Here's what they get right--and what's missing for enterprise security. ## Claude Code Security: A Welcome Evolution in the Remediation Loop DevFeed: [Claude Code Security: A Welcome Evolution in the Remediation Loop]() Original publisher: [Read original article]() Author: Manoj Nair Published: 2026-02-23T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Claude Code](), [anthropic](), [Vulnerabilities](), [AI-assisted coding](), [Application Security](), [Securing AI](), [code security](), [Large Language Model](), [Frontier AI](), [vulnerability]() Tags: [ai](), [ai-security](), [anthropic](), [application-security](), [awareness](), [blog](), [claude-code](), [code-security](), [cybersecurity](), [devops](), [devsecops](), [executive](), [frontier-ai](), [interest](), [llm](), [open-source-security](), [pmm](), [review](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [tech](), [validation](), [vulnerabilities]() ### AI overview Claude Code Security is presented as a major advance in vulnerability discovery and patch drafting, but the article argues that enterprise security still requires deterministic and dynamic validation, remediation automation, and governance. It emphasizes that secure code generation remains difficult because AI-assisted development can introduce business logic, authorization, injection, and cross-file vulnerabilities. ### Source excerpt Anthropic's Claude Code Security marks a major shift in vulnerability discovery, but AI-driven development requires more than just reasoning to remain secure. Learn how Snyk's AI Security Fabric integrates with Claude to close the loop between finding vulnerabilities and fixing them at scale. ## Snyk and Cline: Securing the Future of Autonomous Coding DevFeed: [Snyk and Cline: Securing the Future of Autonomous Coding]() Original publisher: [Read original article]() Author: Carey Stanton Published: 2026-02-18T05:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [agentic-coding](), [Security](), [ai-coding](), [Model Context Protocol](), [coding](), [Pull Request]() Tags: [agentic](), [agentic-coding](), [agents](), [ai](), [ai-coding](), [americas](), [application-security](), [autonomous](), [blog](), [code-security](), [coding](), [developer](), [devsecops](), [enablement](), [enterprise](), [executive](), [external](), [integration](), [interest](), [model-context-protocol](), [pmm](), [pull-request](), [reactive](), [related-content](), [review](), [scm](), [security](), [snyk-code](), [snyk-platform](), [snyk-security-intel](), [tech](), [vs-code]() ### AI overview Snyk and Cline announce a partnership to integrate enterprise security intelligence into autonomous coding workflows. Using the Model Context Protocol, Snyk Studio guides Cline's agent in real time, helping enforce security standards before generated code reaches a pull request. ### Source excerpt Snyk and Cline have partnered to integrate enterprise-grade security directly into autonomous coding loops. By bridging the trust gap, Snyk and Cline enable teams to innovate faster while maintaining rigid security and compliance standards. ## Weaving Security into the Flow: New Snyk Studio Capabilities Power the AI Security Fabric DevFeed: [Weaving Security into the Flow: New Snyk Studio Capabilities Power the AI Security Fabric]() Original publisher: [Read original article]() Author: Daniel Berman Published: 2026-02-17T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Securing AI](), [AI Development](), [Security](), [ai-coding](), [Claude Code](), [Command-line interface](), [pull-requests](), [cursor]() Tags: [ai](), [ai-development](), [ai-security](), [application-security](), [blog](), [claude-code](), [cli](), [code-security](), [cursor](), [developer](), [developer-velocity](), [devsecops](), [enablement](), [interest](), [pmm](), [pull-requests](), [scm](), [security](), [snyk-code](), [snyk-platform](), [supply-chain-security](), [vulnerability-insights](), [workflows]() ### AI overview Snyk Studio announces new capabilities for securing AI-driven development, including streamlined integrations with Gemini CLI and Claude Code, automated remediation that generates pull requests, and enterprise reporting and controls. The update embeds security into developers' existing workflows so AI-assisted code can be secured from the first prompt while supporting developer velocity and governance. ### Source excerpt Snyk Studio is redefining AI development security with new integrations for Gemini CLI and Claude Code, enabling developers to build fast without sacrificing safety. Bridge the gap between developer velocity and governance to ensure your code is secure at inception. [Next page]()