Docker is highlighting critical security failures in the AI coding agent ecosystem. Citing a report that developers use AI in 60% of their work, the company warns that the shift to coordinated agent teams is creating new vulnerabilities for developer infrastructure.
A recently leaked malware kit named "Shai-Hulud" is now being used in a new campaign targeting the npm registry. Attackers are publishing infected packages to steal sensitive information from developers' systems, including credentials and cryptocurrency wallets. This highlights the ongoing risk of software supply chain attacks.
OpenClaw has published its security roadmap, detailing future plans to enhance its open-source AI platform. Key focus areas include securing the software supply chain with SLSA, implementing runtime sandboxing for models, improving data encryption and privacy, and pursuing SOC 2 and ISO 27001 compliance.
Grafana has disclosed a security incident where an unauthorized party gained access to its GitHub environment using a stolen token. The attacker was able to download the company's codebase. Grafana's investigation found no evidence that customer data or systems were affected by the breach.
A new guide shows developers how to build Web3 wallet authentication using Python's FastAPI and Web3.py. The method replaces traditional passwords with cryptographic signatures, detailing a flow from nonce generation and user signing to signature verification and issuing JSON Web Tokens (JWT) for secure access.