Appsec adventures

OpenAI has released GPT-6 Astra, described as its most intelligent and aligned model to date, with strong capabilities in computer use, software engineering, science, and cybersecurity. The model demonstrated the ability to identify and develop zero-day exploits, scoring 100% on ExploitBench and discovering two previously unknown vulnerabilities during internal evaluations. In response to these advanced cyber capabilities and lessons from the Hugging Face incident, OpenAI paused some training to implement stricter alignment protocols and safety processes. Astra now includes human oversight features that can slow, pause, or stop its work and request user review before proceeding with certain actions. The model excels in benchmarks, including 98% on FrontierMath Tier 4 and 88% on SRE-Bench for reverse-engineering tasks. Despite its power, Astra is more likely to refuse advanced cybersecurity tasks such as creating proofs-of-concept. It is rolling out to limited organizations initially an...

On September 2, 2026, Google unveiled Mantis, an open-source framework that uses AI to automate the entire software vulnerability lifecycle—from discovery and candidate triage to reproduction and remediation. The framework addresses the challenge of low-precision AI code scanning, where true positive rates can fall below 7%, by employing multiple AI agents for layered verification and reproducing vulnerabilities in isolated sandbox environments before generating remediation code. Mantis uses hierarchical security summarization to reduce token overhead by over 85% while preserving critical structural information, enabling large-scale repository analysis. It is accessible via Gemini CLI and Antigravity CLI, and includes "mantis-advise" for development-time guidance based on historical vulnerability data. Concurrently, Google announced "Gemini 3.8 Flash Cyber," a security-specialized AI model that improved patch accuracy by 2.6x within the Chrome team and discovered a ...

This August 2026 draft guide from NIST provides practical, actionable methods for using AI to help organizations analyze, plan, implement, and monitor progress toward achieving CSF 2.0 outcomes. It offers structured AI prompts as tools for practitioners to create CSF-related artifacts and illustrates current practices in prompt engineering for CSF implementation. The document contains three notional use cases with example prompts, simulated organizational files for a fictitious company, and tips for getting started. Use Case 1 demonstrates an AI-assisted review of cybersecurity policy and governance alignment with CSF outcomes. Use Case 2 shows how to produce a draft Organization Current State Profile by mapping artifacts and interview notes to CSF outcomes. Use Case 3 illustrates creating a draft CSF target state profile based on internal and industry references. The guide includes specific precautions denoted with /!\ notation where needed, though it does not focus on AI best practic...

This article provides a practical guide to selecting hardened container base images as a foundational security layer for Kubernetes environments, emphasizing that risk is inherited from the base image regardless of other controls like admission policies or runtime monitoring. It evaluates eight leading options based on criteria including minimal packages, active patching, SBOM visibility, provenance, compatibility, and developer usability. The list features Echo (prioritizing CVE-free images with application compatibility), Docker Hardened Images (familiar, secure-by-default), Chainguard Images (minimal Wolfi-based OCI images), Google Distroless (runtime-only without OS extras), Red Hat UBI Micro (enterprise RHEL-based minimal foundation), Ubuntu Chiseled Containers (distroless-style Ubuntu runtime), Iron Bank (hardened images for regulated/government environments), and Bitnami Secure Images (hardened application images for common open-source components). The article advises a tiered s...

Endor Labs has launched Package Firewall, a new capability that blocks malicious, vulnerable, and non-compliant open-source packages before they reach developer machines or CI runners. The firewall sits between developer tools (including AI coding agents like Cursor and Claude Code), private registries, and public repositories, intercepting every install request. It uses a real-time malware feed updated within minutes of new package releases, with an AI-enhanced analysis pipeline that scans npm, PyPI, and Go ecosystems. The tool addresses the sharp rise in software supply chain attacks—including a 14x increase in OSV malware advisories over two years and 92% of npm account takeovers occurring in 2025. Recent incidents like backdoored versions of popular packages (lightning, axios, telnyx) highlight the need for immediate enforcement. Beyond malware, Package Firewall enforces organizational policies to block packages with known vulnerabilities or license violations and supports features...

As global cybersecurity spending approaches $240 billion and the average data breach cost hits a record $4.99 million, a growing affordability crisis is leaving small and midsize businesses (SMBs) dangerously exposed, threatening overall supply chain security. The market disproportionately serves large enterprises, with vendors developing expensive tools that don't account for SMBs' lack of dedicated security teams or 24/7 operations centers. AI adoption is adding cost pressure without guaranteed returns—research shows AI-generated patches fail or introduce new issues over 53% of the time. Security teams face tool sprawl (averaging 83 tools from 29 vendors), overlapping findings, and rising costs that outpace budget growth. Experts recommend shifting focus from raw findings to measurable risk reduction, applying cost governance to AI spending, and adopting frameworks similar to FinOps to ensure every dollar and engineering hour addresses the most critical exposures. The crisis ...