Security

Corgea delivers an 80% reduction in remediation effort — not by detecting vulnerabilities faster, but by generating the code fix as a pull request. The traditional SAST workflow is: scan → find vulnerability → file ticket → developer manually writes the fix → PR review → merge. Corgea changes step three onward: scan → AI agent analyzes finding with full codebase context → generates fix code → opens PR for developer review. The AI application security market is projected to reach $5 billion by 2027, and the core problem Corgea addresses is real: codebases are growing faster than security headcount can keep pace. Traditional SAST tools generate false positive rates high enough that developers treat alerts like spam. Corgea’s AI-native approach — not a rule engine with AI bolted on — produces contextually accurate fixes that reduce alert fatigue alongside vulnerability count. ...

For a remote MCP server, the key question is not whether a request contains a bearer token. It is whether that token is valid for this server and whether its owner may perform the requested operation on the requested resource. This guide follows the linked authorization specification and gives an implementation-review checklist. It does not claim that a short example is a complete authorization server. The previous adoption percentages and “working production implementation” framing were not supported by the available evidence. ...

Giving an AI agent a raw API key is structurally equivalent to handing your housekeeper a master key with no expiry date, no audit trail, and no way to revoke access to a specific door. Peta fixes this by acting as a control plane that intercepts every credential request, enforces a least-privilege policy, and injects short-lived scoped tokens at runtime — so the agent never sees your actual secrets. Why Raw API Keys Are a Structural Risk for AI Agents Raw API keys given to AI agents represent a fundamentally broken security model, and the breach statistics for 2025 prove it. GitGuardian’s 2026 report found that 28,649,024 new secrets were exposed in public GitHub commits in 2025 — a 34% year-over-year increase and the largest annual jump ever recorded. Of those, over 1.2 million were AI-service credentials, with 81% year-over-year growth; 12 of the top 15 fastest-growing leaked secret types were AI services. OpenRouter credential leaks alone grew more than 48x year-over-year as agents used it as a gateway to multiple models through a single shared key. Even Claude Code co-authored commits leaked secrets at roughly double the baseline rate. These numbers expose a systemic failure: the tooling that makes agents useful is also making credential hygiene nearly impossible to enforce through discipline alone. The root problem is structural — raw API keys have no concept of intent, scope, caller identity, or time limit, so any agent that holds one has more power than it needs and no mechanism to prove it used that power appropriately. ...

ProjectDiscovery Neo is an autonomous AI security engineer that runs real exploit chains, not just detection passes. In a three-application benchmark spanning banking, healthcare, and insurance targets, Neo confirmed 66 exploitable vulnerabilities — the highest count of any tool tested — including 24 findings that no other scanner or agent caught. What Is ProjectDiscovery Neo? (The Nuclei-Powered AI Security Engineer) ProjectDiscovery Neo is an autonomous penetration testing platform built on the Nuclei toolchain, designed to behave like a senior security engineer: it plans attack chains, executes exploits, validates impact, and returns proof packs that your team can replay. Unlike traditional scanners that flag potential issues, Neo confirms whether a vulnerability is actually exploitable before reporting it. The platform launched commercially at RSAC 2026 in March after ProjectDiscovery won the RSAC 2025 Innovation Sandbox — the highest-profile pre-launch validation any AI security startup has received. Underneath Neo sits Nuclei, the open-source engine that has completed over 10 billion scans and is maintained by a community of 100,000+ security engineers with 9,000+ YAML templates covering CVEs, misconfigurations, and custom attack patterns. Neo takes this attack-pattern library — which no new AI security startup can replicate overnight — and wraps it inside an agentic loop powered by Claude Opus 4.5, running 30+ agent-native security tools inside isolated sandboxes. The result is a tool that combines breadth (every CVE template Nuclei ships) with depth (multi-step reasoning to chain vulnerabilities into working exploits). ...