Topic
MIT-licensed, cross-language security packages distributed across PyPI, npm, NuGet, crates.io and Go module registries.
Visa has begun letting certain AI agents transact on its card network without disclosing the controls that authorise them. Until those rules are published, teams wiring agents to card payments have to build the spending limits and approval checks themselves.
Reality
The open-source layer from PrismorSec sits between Claude Code, Codex or Cursor and the shell, returning allow, warn or block on each call. Its own scoring puts the everyday preset at 31 percent coverage.
Reality
Cisco Talos released its CAIRN framework on September 22nd to hunt prompts, provider endpoints and API-key prefixes in malware metadata. Its first case study polls four commercial models and runs the winner.
Reality
DeepZero automates the hunt for exploitable Windows kernel drivers, discarding everything already on loldrivers.io before a language model rates what survives. Its maintainer reports multiple verified bugs in a driver installer corpus.
Reality
Tencent's Zhuque Lab has put its AI asset scanner on GitHub for nothing. The skill auditor asks a language model whether code looks malicious, and the lab's own benchmark puts the false positive rate anywhere between 1.2 and 18.67 percent.
Reality
A Yamato Security engineer maps CloudTrail events to seven ATT&CK tactics and drops techniques nobody has observed. The pruning is the useful part, and it will date fast.
Reality
A read-only sensor for cross-tenant memory leaks ships with no tagged release, because its own backend cannot enumerate what the retriever exposed. That limitation is the story.
Reality
Agent Governance Toolkit puts policy checks in the execution path rather than the prompt. The seam: the kernel is middleware inside the agent's process, so containers still do the isolating.
Reality