Posts

On June 25, 2026, the Mozilla 0DIN team demonstrated an attack that should change how every team deploys AI coding agents. They published a normal-looking Python repository on GitHub. A developer cloned it and pointed Claude Code at it. The agent read the README, installed the requirements, hit a routine initialization error, and — trying to be helpful — ran the suggested fix. That fix queried a DNS TXT record, decoded the value, and executed it as a shell command, opening a reverse shell on the developer’s machine. ...

If your coding agents can’t see your artifact repository, they’re flying blind. They’ll guess dependency versions, hallucinate package names, and suggest upgrades that don’t exist. But giving an AI agent direct access to Artifactory is a bad idea — one prompt injection and your entire binary repository is an attack surface. JFrog solves this with two complementary paths: JFrog Skills (open-source agent skills) and the JFrog MCP Server (remote SaaS MCP server). Both give agents safe, governed access to artifact context, but they work differently and suit different use cases. Here is how both work, when to use each, and how to set them up without compromising security. ...

If your team is running AI coding agents in production — Claude Code, Cursor, Windsurf, GitHub Copilot — you’ve probably already felt the gap between traditional AppSec and what these agents actually do. Traditional security tools scan committed code. Agents don’t just write code; they install MCP servers, download skills, run shell commands, and make API calls. By the time a traditional SAST scan runs, the damage is already done. ...

SonarQube MCP Server is SonarSource’s official open-source bridge between AI coding agents and SonarQube’s code quality engine. Instead of context-switching to a browser dashboard or running CLI scans manually, your AI agent can query issues, check quality gates, analyze code snippets, review security hotspots, and even change issue status — all through MCP tool calls. Version 1.19.0 ships with 20+ tools, supports every major AI client from GitHub Copilot to Claude Code, and works with both SonarQube Cloud and self-hosted Server instances. ...

If you’re using AI coding agents in 2026, you’ve probably hit the wall where your agent needs the same workflow — review a PR, run a specific test pattern, deploy to staging — and you end up pasting the same instructions every time. VoltAgent’s awesome-agent-skills repository solves that. It’s a curated collection of 1,000+ reusable agent skills compatible with Claude Code, OpenAI Codex, Cursor, Gemini CLI, and more. With 27,286 stars and 2,922 forks as of July 2026, it’s the largest community-driven skills directory in the ecosystem. Here’s how to use it, how to evaluate skill quality, and how to contribute your own. ...

AI coding agents ship code faster than ever, but when they break, the debugging experience is nothing like a traditional stack trace. You don’t get a line number and a segfault — you get a silent hang, a garbled terminal, a 529 from the API, or an MCP server that just won’t connect. After spending the last year running Claude Code, Codex CLI, GitHub MCP Server, and Playwright MCP in production pipelines, I’ve collected the debug patterns that actually work. Here’s the field guide I wish I’d had. ...

If your team is shipping AI-generated code into production — and let’s be honest, most teams are — you’ve probably noticed the gap. AI agents write code fast, but they also introduce subtle bugs, logic errors, and security vulnerabilities at a rate that manual review can’t keep up with. Sonar’s January 2026 State of Code survey found that AI accounts for 42% of committed code among surveyed developers, yet 96% don’t fully trust AI-generated code, and only 48% always check it before committing. That’s a verification gap, and it’s growing. I’ve spent the last few weeks evaluating the four leading verification platforms that claim to close this gap: SonarQube, Snyk, Aikido, and CodeQL. Here’s what I found. ...

Agent Skills supply chain security means treating every SKILL.md, referenced file, script, and marketplace update as executable influence over your AI agent. In practice, skills are closer to npm packages or CI actions than documentation, because a small metadata change can redirect planning, tool use, file access, and data movement. Why did Agent Skills become a supply chain problem in 2026? I’ve found that teams adopt Agent Skills for the same reason they adopted package managers: reuse beats rebuilding every workflow by hand. A skill can package conventions for code review, deployment, incident response, design handoff, or data analysis. The format is intentionally lightweight, which is exactly why it spreads quickly across tools such as Claude Code, OpenAI Codex, Cursor, GitHub Copilot, Gemini CLI, VS Code, Windsurf, and OpenClaw-style marketplaces. ...

Dataverse is becoming Microsoft’s governed data and tool layer for enterprise agents: records, metadata, security roles, semantic models, Business Skills, and MCP endpoints in one place. For developers, the practical question is no longer “can my agent reach Dataverse?” It is “which Dataverse interface should this workflow use, and how do I keep it governed?” What does Microsoft mean by Dataverse as an agent data platform? Microsoft’s 2026 positioning is more specific than the older “Dataverse is a business data store” message. The new claim is that Dataverse can give agents business understanding, not just API access. That means an agent should be able to discover tables, understand relationships, respect role-based security, call reusable business processes, and operate through approved tools. ...

GitHub Copilot browser tools are now generally available in VS Code, and the practical change is simple: Copilot can inspect the UI it just helped build. In practice, that turns agent mode from a code-edit loop into a build, open, click, debug, patch, and verify loop inside the editor. What does GitHub Copilot Browser Tools GA mean in VS Code? GitHub announced general availability for browser tools for GitHub Copilot in VS Code on July 1, 2026. The GA announcement matters because browser interaction is no longer a preview-only experiment that teams evaluate on the side. It is part of the normal Copilot agent workflow in VS Code. ...