AI × AppSec Hub — Edition 1

This week AI showed both sides of the AppSec story. AI-written code got measurably safer for the first time in a year. In the same week, researchers caught the first known in-the-wild attack that turned a coding agent against its own user.

The AI × AppSec Hub is a weekly roundup of published work on how AI is changing application security, for the people who build and defend software. Each edition covers the research, attacks, tools and practical lessons from the past seven days.

Top story: AI-written code gets safer, but still fails 38% of security tests

On October 29, Veracode's Fall 2026 GenAI Code Security report recorded the first real improvement since the series began in July 2025. Across 18 models, the average security pass rate rose from 56% to 62%. The share of tasks that produced vulnerable code fell from 44% to 38%.

• Top models: Claude Opus 5.5 and GPT-6-Sol tied at 73%, beating the previous record of 68%. The weakest models scored 44–50% (Tech Insider).
• Gains were in easy patterns. Cross-site scripting improved the most. Log injection, which needs data-flow reasoning, stayed near 12% (CYBR.SEC.Media).
• Java is the weak spot. Java passed only 31%, against 64% for Python, 60% for C# and 57% for JavaScript.
• Cost matters. Veracode's Chris Wysopal noted that the most secure models are also the most expensive to run at scale.

Why it matters: Even the best model writes insecure code more than one time in four. AI output still needs SAST, dependency and secrets scanning on every merge. Put extra human review on Java, logging code and anything that traces untrusted input.

Research and reports

Gemini 4 Carbon leads on finding, exploiting and fixing bugs. Google announced Gemini 4 Carbon on October 28. It scored 88.2% on SEC-bench Pro (finding vulnerabilities), 54.8% on ExploitGym (exploiting them) and 71.0% on CWE-bench (patching them). Google says these ran without guardrails. Access starts with vetted cyber defenders through its Fairwind Program, and there's no public date yet (AI TL;DR). The 71% patch score matters most for AppSec. A patch only counts if the exploit stops working and every existing test still passes (WinBuzzer).

Anthropic shows AI-built exploit chains. On October 27, Anthropic's Frontier Red Team published a paper saying an unreleased internal model built five working exploit chains, against Chrome, Safari, Windows, Linux and Android. The Linux chain targets a use-after-free in multipath TCP (summary). Reports differ on whether every Linux distribution has shipped a fixed kernel, so check your vendor's advisory.

[un]prompted II, October 27–29. This practitioner AI security conference in San Francisco produced much of the week's research, including the GitHub prompt-injection scan below. Google DeepMind's Elie Bursztein also presented Capsem, which uses hardware isolation to sandbox AI agents without slowing them down (CYBR.SEC.Media).

Securing AI apps and agents

A markdown file hijacked coding agents in the wild. Forever Security caught a malicious website silently dropping a file named AGENTS.md into a victim's Downloads folder, disguised as engineering notes. When the user started Codex or Claude Code in that folder, the agent read the file as trusted project instructions. The file told the agent to rewrite its own configuration and try to install an npm package, setting up token theft. The real-world attempt was blocked before any code ran (Aviatrix analysis, Oct 27). No patch is coming, because the agents are working as designed. The fix has to come from the trust model: which folders an agent runs in, and what it is allowed to reach.

14 flaws turn prompt injection into code execution. Endor Labs researcher Peyton Kennedy found 14 critical and high-severity bugs across seven AI workflow platforms: Flowise, Langflow, Dify, Activepieces, Kestra, Apache Airflow and NocoBase. Several chains let an unauthenticated user go from a chat message to running commands on the server (CYBR.SEC.Media, Oct 28). The common root causes:

• Model output executed as if it were trusted code
• Blocklists that filter strings instead of enforcing a real boundary
• Sandboxes undermined by surrounding code, such as code that runs before isolation starts

Fixed versions include Langflow 1.10.3 or 1.11.0, NocoBase 2.0.39 and Activepieces 0.80.0. Flowise is archived, so plan to migrate off it.

Hidden instructions are already sitting in GitHub. Radware scanned 86 million GitHub issues, pull requests, comments and READMEs. It found hidden prompt injections, mostly in HTML comments, in about 2.5 of every 100,000 items. Most were harmless automation or growth hacking, but some tried to redirect agents or steal data (CYBR.SEC.Media, Oct 27). If an agent reads repository content, that content is untrusted input.

Tools and industry moves

Cisco open-sources Project Quarry (October 28). Quarry is a rule language and engine for catching agent attacks that look harmless one step at a time. Cisco models it on Snort and YARA. Rules examine LLM conversations, tool calls, MCP interactions and multimodal inputs across a whole session. For example, a rule could flag an agent that reads a credentials file and then sends data to an outside server. Each alert records the evidence that triggered it. The release includes a starter rule pack and plugins for Claude Code, Codex and other MCP-compatible agents (CDO Magazine).

Gemini 4 Carbon goes to defenders first. Google is releasing it to vetted security teams before anyone else, the same approach it used with Gemini 4 Argon a month earlier (see Research and reports above). Frontier labs are increasingly giving defenders early access to their strongest security capabilities.

What it means for AppSec teams

1. Keep scanning AI-written code. The best models still fail 27% of security tests. Run SAST, dependency and secrets scanning on every AI-assisted merge, and fail builds on high-severity findings.
2. Treat everything an agent reads as untrusted. That includes instruction files like AGENTS.md, READMEs, issues, emails and web pages. Authority should come from identity and workflow controls, never from text an agent happens to read.
3. Limit where agents run and what they can reach. Keep agents inside project folders, block egress to unapproved package registries, and give them least-privilege credentials.
4. Check that your sandboxes actually isolate. Confirm nothing runs before isolation starts and that paths can't escape to the host. A blocklist is not a boundary.
5. Watch sequences, not single actions. Agent attacks often look like a series of permitted steps. Session-level detection such as Quarry is worth piloting.
6. Patch your AI workflow platforms. If you run Langflow, NocoBase, Activepieces or Flowise, upgrade or migrate now.

See you next week for Edition 2. All sources are linked inline above.