Last week I scanned serena — a popular AI coding assistant with 25k ⭐. [BLOCK] COMMAND_INJECTION ...
Last week I scanned serena — a popular AI coding assistant with 25k ⭐.
[BLOCK] COMMAND_INJECTION agent.py:1222
subprocess.Popen(cmd, shell=True)
→ config value → arbitrary shell execution
Enter fullscreen mode
Your AI coding agent can read files, run shell commands, and call external APIs. That's also the...
AI coding agents — Lovable, bolt.new, Cursor, Replit — have made it possible for anyone to ship a...
TL;DR what: Attackers inject crafted markdown into Sentry error events that AI coding...
A new CVE against Cursor, a LiteLLM supply-chain backdoor, and a study showing image-only injection...
I ran my own AI chatbot plugin through a security review before release, and it came back with 35...
I spent two semesters building an AI agent that runs penetration tests. For the non-hackers in the...
