The Future of Vibe Coding Security (Part 10)

Vibe Coding Security Series

What Is Vibe Coding Security? A Field Guide for 2026

The OWASP Top 10 for Vibe-Coded Applications

Anatomy of a Vibe Coding Breach: Lessons from 2026’s Worst Incidents

The Dependency Trap: Supply Chain Risks in AI-Generated Code

Authentication & Secrets: What AI Gets Wrong Every Time

Scanning Vibe-Coded Apps: Why Traditional SAST/DAST Falls Short

Prompt Engineering for Secure Code

The Founder’s Security Checklist

Securing the AI Coding Pipeline

The Future of Vibe Coding Security (you are here)

Read Time: 26 minutes

TL;DR

The vibe coding security landscape is splitting in two directions simultaneously. On one side: regulation is arriving (EU Cyber Resilience Act vulnerability reporting starts September 2026, insurers are excluding AI-generated code from coverage), autonomous agents are creating attack surfaces we haven’t mapped yet (zero out of 2,000 surveyed MCP servers had authentication), and model poisoning means the AI itself might be compromised before you write your first prompt. On the other side: AI-powered defense is finally catching up (hybrid AI+SAST eliminates 94-98% of false positives, AI-driven vulnerability detection finds twice what traditional tools miss), new frameworks for agent governance exist, and the industry is building the certification and standards infrastructure that vibe coding has lacked. This final article in the series looks at both trajectories and gives you a practical roadmap for 2027.

Where We’ve Been: A Series in Retrospect

When I started this series in April, a founder had just shown me an app built entirely with AI prompts. It worked. It also had SQL injection in the login form, hardcoded database credentials in the client-side JavaScript, and an admin panel accessible to anyone who guessed the URL. That app — and the dozens like it I’d been seeing at VULNEX — became the reason for writing ten articles about a problem that most of the industry was still treating as a novelty.

The arc of this series traced the lifecycle of vibe-coded insecurity:

Part 1 defined the field. Eighty-four percent of developers use or plan to use AI coding assistants, but the security conversation hadn’t caught up with the adoption curve. Part 2 mapped how the OWASP Top 10 manifests differently in AI-generated code — the same vulnerability categories, but different patterns and higher density. Part 3 showed what happens when those vulnerabilities reach production through real breach case studies.

Then we went deeper into specific attack surfaces. Part 4 covered the dependency supply chain — hallucinated packages, phantom dependencies, slopsquatting. Part 5 documented how AI consistently fails at authentication and secrets management. Part 6 explained why traditional scanning tools miss AI-specific vulnerability patterns.

The final stretch focused on defense. Part 7 showed how to engineer prompts that produce more secure code. Part 8 gave founders a pre-launch checklist. Part 9 covered the toolchain itself — every stage from the model to production, and the attacks targeting each one.

If I’m honest about what surprised me: when I started Part 1, I thought dependency poisoning and hallucinated packages were the most urgent threat. By Part 9, it was clear that the toolchain attack surface — MCP servers, IDE extensions, AI configuration files — was evolving faster than anything else in the field. The vulnerabilities in the code were bad. The vulnerabilities in the tools that produce the code were worse. That realization reshaped the second half of this series and drives most of what I’ll cover in this final article.

That was the present. This article is about what comes next.

The Regulatory Wave

The EU Moves First

Two pieces of EU legislation are about to reshape how organizations handle AI-generated code, and neither one mentions “vibe coding” by name.

The EU AI Act entered into force in August 2024, with enforcement rolling out in phases. General-purpose AI rules took effect in August 2025. On August 2, 2026, Article 50 transparency obligations and penalty powers activate — with maximum fines of 15 million euros or 3% of global turnover, whichever is higher. AI coding tools haven’t been classified as high-risk under the Act, but the general-purpose AI provisions still apply to the foundation models that power them.

More consequential for development teams is the EU Cyber Resilience Act. It entered into force in December 2024, and it doesn’t distinguish between human-written and AI-generated code. Vulnerability reporting obligations begin September 11, 2026 — two months from now. Manufacturers must report actively exploited vulnerabilities within 24 hours. Full compliance is required by December 2027. If your vibe-coded app ships to EU customers, the CRA applies regardless of how the code was produced.

In the United States, the approach has been lighter. The June 2, 2026, executive order “Promoting Advanced AI Innovation and Security” established a voluntary framework for government review of frontier AI models and directed agencies to develop AI cybersecurity benchmarks. It created an “AI cybersecurity clearinghouse” but stopped short of mandatory requirements for AI-generated code. No federal law specifically targets AI coding tools as a distinct category.

The Insurance Industry Pulls Back

While governments debate regulation, insurers are already making decisions with their wallets. In January 2026, the Insurance Services Office introduced a generative AI exclusion for commercial general liability policies, excluding coverage for bodily injury, property damage, and personal injury arising from generative AI. The Geneva Association noted in late 2025 that limited loss data and information asymmetry make AI risk “technically unresolvable with current data.”

Translation: if your AI-generated code causes harm, your insurance may not cover it. Coverage is fragmenting across cyber, Tech E&O, D&O, and EPLI lines, creating gap risk that K&L Gates identified as “the next wave of litigation.”

No lawsuits specifically about AI-generated code vulnerabilities have been publicly reported through mid-2026. The EU Product Liability Directive transposition deadline — December 2026 — will extend strict liability to software including AI systems. When the litigation starts, it will start fast.

Standards and Certification Catch Up

The standards infrastructure is finally catching up. On February 17, 2026, NIST’s Center for AI Standards and Innovation launched the AI Agent Standards Initiative — the first federal effort to set interoperability, security, and identity standards for autonomous AI agents that write and execute code. An AI Agent Interoperability Profile is planned for Q4 2026.

On the same day, CompTIA launched SecAI+ (exam CY0-001), its first certification at the intersection of AI and cybersecurity. Four domains: Basic AI Concepts (17%), Securing AI Systems (40%), AI-Assisted Security (24%), and AI Governance, Risk, and Compliance (19%). It’s not deep enough for offensive security work, but it signals that the industry recognizes the skills gap.

The Agent Era

Every MCP Server Fails the Same Test

In Part 9, I covered MCP vulnerabilities — the CVEs, the tool poisoning, the auto-execution attacks. That was the present. The future is worse.

Knostic performed a security scan of approximately 2,000 MCP servers. Every single one lacked authentication. Not most. Not a significant portion. All of them. The protocol that connects AI models to tools, databases, and APIs across the development ecosystem has zero authentication as the default state.

Two competing protocols now define how agents communicate: Anthropic’s MCP (Model Context Protocol) and Google’s A2A (Agent-to-Agent), announced in April 2025 with over 50 industry partners. Both are racing for adoption. Neither has solved the fundamental authentication problem at the protocol level.

A March 2026 paper proposed AIP — Agent Identity Protocol — for cryptographic delegation chains across MCP and A2A. The emerging consensus among researchers is that mutual TLS, signed agent cards, and PKI-backed identities are the minimum viable solution. OAuth tokens alone are insufficient because they weren’t designed for machine-to-machine delegation chains where the “user” is itself an agent acting on behalf of another agent.

Deploying Without Permission

Gravitee’s “State of AI Agent Security 2026” report surveyed technical teams about agent deployment readiness. The results tell a familiar story: 80.9% of teams have moved past planning into active testing or production deployment of AI agents. Only 14.4% report agents going live with full security and IT approval. Eighty-one percent feel pressure to deploy agents before governance frameworks are ready.

This is the cloud migration pattern all over again — adopt first, secure later — except agents have broader system access than cloud instances ever did. An AI agent with MCP access can read your files, query your databases, execute commands, send messages, and deploy code. A misconfigured EC2 instance can’t do most of that.

The OWASP Response

OWASP published its Top 10 for Agentic Applications in December 2025, recognizing that the original LLM Top 10 didn’t adequately cover the risks of autonomous agents. The number-one risk: Agent Goal Hijacking — manipulating an agent into pursuing objectives that benefit the attacker rather than the user. This is prompt injection applied to agents that can take actions, not just generate text. The full list also includes Memory and Context Poisoning, Cascading Failures across multi-agent systems, and Rogue Agents operating outside their intended boundaries — each one a distinct class of risk that didn’t exist eighteen months ago.

Microsoft’s response arrived in April 2026: the Agent Governance Toolkit, released under MIT license. It’s the first open-source framework addressing all 10 OWASP agentic risks with deterministic, sub-millisecond policy enforcement. It integrates with LangChain, CrewAI, Google ADK, and OpenAI’s Agents SDK. It’s a start — but a toolkit is only useful if teams actually adopt it, and the Gravitee numbers suggest most aren’t waiting for governance.

The scale of the problem continues to grow. Google researchers measured a 32% increase in malicious prompt injection payloads embedded in web content between November 2025 and February 2026. Every web page an agent browses, every document it reads, every API response it processes is a potential injection vector. As agents become more autonomous, the attack surface doesn’t grow linearly — it grows combinatorially.

When Agents Find Zero-Days

In April 2026, Anthropic disclosed Claude Mythos Preview — a frontier model capable of autonomously identifying and exploiting zero-day vulnerabilities. Through Project Glasswing, Mythos scanned over 1,000 open-source projects and identified 23,019 issues, including 6,202 at high or critical severity. By May 2026, 1,596 findings had been disclosed through coordinated vulnerability disclosure programs.

This is an inflection point. The same autonomous capability that finds vulnerabilities for defenders can find them for attackers. Anthropic chose coordinated disclosure. A state-sponsored actor with equivalent capability would not. The asymmetry between attack and defense that has defined cybersecurity for decades is about to accelerate.

Google DeepMind responded with an “AI Control Roadmap” in June 2026 for defense-in-depth management of potentially misaligned agents. Anthropic, OpenAI, and Block co-founded the Agentic AI Foundation under the Linux Foundation in late 2025, recognizing that agent safety is a shared problem no single company can solve.

Meanwhile, Google DeepMind, Schmidt Sciences, the Cooperative AI Foundation, and ARIA announced a $10 million funding initiative on June 11, 2026, targeting multi-agent AI safety research. The focus: emergent population-level risks when agents from different organizations interact in shared environments.

AI vs AI: The Defense Evolves

Finding What Humans Miss

The security tooling picture is shifting from “AI generates code, humans review it” to “AI generates code, AI finds the bugs, humans make the decisions.”

IRIS, presented at ICLR 2025, demonstrated what this looks like in practice. It’s a neuro-symbolic system that combines LLMs with CodeQL’s static analysis. Using GPT-4, IRIS detected 55 vulnerabilities in real-world Java projects — 103.7% more than CodeQL found alone — while reducing the false discovery rate by 5.21%. It also discovered four previously unknown vulnerabilities. The system is open source.

SAST-Genius, presented at IEEE S&P 2025, takes the complementary approach: using LLMs to filter SAST false positives. Hybrid configurations eliminate 94-98% of false positives. This matters because alert fatigue — the problem I described in Part 6 and Part 9 — is the reason 40% of security alerts go uninvestigated. If AI can reliably separate real vulnerabilities from noise, human reviewers can focus on what actually matters.

Security Copilots Go Enterprise

Microsoft Security Copilot began rolling out to all M365 E5 customers in November 2025, shipping with over 40 agents spanning Defender, Entra, Intune, and Purview. This isn’t a chat interface that answers security questions — it’s an orchestration layer where specialized AI agents handle triage, investigation, and response across Microsoft’s security stack.

Google launched AI Threat Defense on May 27, 2026, integrating Wiz (cloud exposure mapping), CodeMender (AI code repair), Gemini (reasoning), and Mandiant (threat intelligence) into a unified defense platform. Specialized agents handle Detection Engineering and Threat Hunting as distinct workflows.

CrowdStrike unveiled Charlotte Agentic SOAR in November 2025, replacing legacy security orchestration with AI agents that make real-time decisions across seven mission-ready roles.

The pattern across all three: security is moving from human-driven investigation assisted by tools to AI-driven investigation supervised by humans. Dropzone AI reports that AI-augmented threat hunting compresses 40-hour manual investigations to approximately one hour. Organizations deploying AI and automation in security operations reduced breach identification and containment by an average of 80 days.

Automated Code Repair

Google DeepMind’s CodeMender, announced in October 2025, uses Gemini Deep Think models combined with static analysis, dynamic analysis, fuzzing, and SMT solvers to find and fix security vulnerabilities automatically. In its first six months, it upstreamed 72 security fixes to open-source projects — some with codebases exceeding 4.5 million lines. All patches undergo human review before merging.

This is the missing piece in the vibe coding security pipeline. Today, AI generates vulnerable code, humans find it, and humans fix it. Tomorrow: AI generates code, AI finds the vulnerabilities, AI proposes fixes, and humans approve. The human role shifts from doing the work to governing the process.

The Threats We Haven’t Seen Yet

Poisoning the Models Themselves

Everything in this series assumed the model itself was trustworthy — flawed in its output, certainly, but not deliberately compromised. That assumption has an expiration date.

Anthropic-affiliated research demonstrated that approximately 250 malicious samples can poison a foundation model regardless of total dataset size — fewer than 0.1% of pre-training data. The backdoors survive fine-tuning and safety alignment. A paper called “BackdoorLLM,” accepted at NeurIPS 2025, formalized the attack. A more insidious variant called “Turn-Based Structural Triggers” (January 2026) showed how to embed backdoors that activate only in specific multi-turn conversation patterns — exactly the kind of interactions developers have with coding assistants.

The practical implication: an attacker who can influence training data doesn’t need to compromise your IDE extensions, your MCP servers, or your CI/CD pipeline. They can compromise the model itself, and the model will generate vulnerable code that passes every review because the vulnerability was designed to look like a reasonable implementation choice.

A sub-trend makes this worse: LoRA adapter poisoning. Small fine-tuning adapters — the kind used to customize models for specific coding tasks — can introduce backdoors that are difficult to distinguish from legitimate fine-tuning. If your organization fine-tunes a model on internal code and an attacker can influence that training corpus, the backdoor propagates to every developer using the fine-tuned model.

Synthetic Developers

North Korean operatives have built synthetic developer identities with fabricated LinkedIn histories and AI-generated profile photos to infiltrate technology companies as remote contractors. Google Threat Intelligence documented threat group UNC1069 transitioning to AI-powered campaigns targeting developers at cryptocurrency exchanges and financial firms using AI-generated personas.

Combine this with the open-source contribution model: a synthetic developer persona, backed by months of legitimate-looking commit history (which is itself AI-generated), submits pull requests to popular repositories. A 2026 Carnegie Mellon study found 6 million fake stars across 18,600+ GitHub repositories, with AI and LLM projects as the most-manipulated category.

In April 2026, the “prt-scan” campaign opened 475 malicious pull requests across repositories in just 26 hours. In July 2026, researchers disclosed that GitHub verified commits can be rewritten into new hashes without breaking signatures — meaning even signed commits may not prove what they appear to prove.

The trust infrastructure that open source relies on — contributor reputation, commit history, signature verification — wasn’t designed for a world where AI can fabricate all of it at scale. And vibe coders are disproportionately exposed: AI coding assistants pull dependencies, suggest libraries, and recommend code patterns from these repositories automatically. A developer manually evaluating a library might notice a suspicious contributor profile. An AI assistant suggesting import compromised-package in response to a prompt won’t.

The Crypto-Agility Deficit

NIST finalized post-quantum cryptographic standards (CRYSTALS-Kyber, CRYSTALS-Dilithium) in 2024. The transition to post-quantum cryptography is already challenging for human-written codebases. For AI-generated code, it’s potentially catastrophic.

AI coding assistants tend to hard-code encryption choices. When I covered authentication in Part 5, the examples showed AI reaching for MD5 and SHA-1 — algorithms that have been deprecated for years. The same pattern applies to cryptographic library selection: the model generates what was common in its training data, not what’s current.

The result is a crypto-agility deficit. Most CI/CD pipelines have deeply embedded legacy cryptographic algorithms that require massive refactoring for post-quantum migration. AI-generated code accelerates this problem because it generates more of the same — hard-coded algorithm choices, no abstraction layers, no crypto-agility design patterns. When the quantum transition arrives, vibe-coded applications will be disproportionately difficult to migrate.

QuickNote: Two Years Later

Let’s project QuickNote — the deliberately vulnerable app from this series — forward two years. Maya, the developer from Part 9, has learned from her mistakes. Here’s what her workflow could look like in 2028 — if we build the infrastructure she needs:

The model she uses has changed. Maya’s coding assistant runs through a corporate proxy that strips MCP configurations from cloned repositories and validates tool descriptions against a known-good registry. The model is fine-tuned on her company’s internal code, but the fine-tuning pipeline includes adversarial testing for backdoor insertion.

Her IDE enforces guardrails. AI configuration files are treated as executable code — diffs are required, hidden Unicode triggers a CI failure, and rule files are signed by approved maintainers. The Extensions she runs were audited by a third-party service that monitors for behavioral changes post-install.

Agents work in sandboxes. Maya’s AI agents operate inside containers with network policies, filesystem restrictions, and credential scoping. No agent inherits her full environment. MCP servers authenticate with mutual TLS and signed agent identities — the protocol matured after the authentication crisis of 2026.

AI reviews AI. Her pull request pipeline runs CodeMender for automated repair suggestions, IRIS for hybrid vulnerability detection, and SAST-Genius for false positive filtering. Human review focuses on architecture decisions and business logic, not the mechanical vulnerability hunting that AI handles better.

Compliance is automated. Her CI/CD pipeline generates a software bill of materials that tracks which portions of the code were AI-generated, which model version produced them, and which security scans were applied. When the EU CRA audit comes, she can demonstrate compliance without scrambling.

The insurance is sorted. Maya’s company carries a dedicated AI code liability rider that was only available because they could demonstrate a documented, auditable AI governance process.

Is this aspirational? Absolutely. Some of these components exist today; others are in early development. Mutual TLS for MCP is still a proposal. AI code provenance in SBOMs is still nascent. Adversarial testing for fine-tuning backdoors is still research. But the trajectory is clear, and every piece I described has teams working on it right now. The question isn’t whether Maya’s 2028 is possible — it’s whether the industry builds it fast enough to matter.

A Practical Roadmap for 2027

Here’s what you should be building or acquiring in the next twelve months, organized by urgency.

Do Now (Q3-Q4 2026)

Prepare for the EU Cyber Resilience Act. If you ship software to EU customers, vulnerability reporting obligations start September 11, 2026. The CRA doesn’t distinguish between human-written and AI-generated code, so this applies to your vibe-coded components equally. Specifically: designate a single point of contact for coordinated vulnerability disclosure, establish an internal vulnerability database that tracks AI-generated code components, build a 24-hour notification workflow to ENISA and your national CSIRT via the Single Reporting Platform for actively exploited vulnerabilities, and document the security support period for each product you distribute. If you don’t have these in place by September, you’re non-compliant on day one.

Inventory your AI agent permissions. The Gravitee data shows 81% of teams are deploying agents without governance. Conduct an audit: which agents have access to which systems? What credentials do they inherit? What actions can they take without human approval? Use OWASP’s Agentic Applications Top 10 as your assessment framework.

Adopt Microsoft’s Agent Governance Toolkit or build equivalent policy enforcement. Sub-millisecond policy checks on agent actions are the minimum viable defense. If your agents can deploy code, modify infrastructure, or access customer data, deterministic guardrails — not probabilistic model behavior — must constrain them.

Build in Q1-Q2 2027

Integrate AI-powered security scanning. Hybrid approaches like IRIS (LLM + CodeQL) and SAST-Genius (LLM false positive filtering) represent the next generation of vulnerability detection. Evaluate them for your stack. The false positive reduction alone justifies the investment — your security team is drowning in alerts they can’t act on.

Implement AI code provenance tracking. Track which portions of your codebase were AI-generated, by which model, and at what version. This is a compliance requirement under the EU AI Act transparency provisions and a liability defense when things go wrong. Tooling for this is nascent but developing — start with metadata in commit messages and build toward automated tracking.

Get your team certified. CompTIA’s SecAI+ is a starting point. SANS, ISC2, and AWS all offer AI security training now. The skills gap between “developers who use AI” and “developers who secure AI” is where most organizations are most vulnerable.

Plan for H2 2027

Prepare for post-quantum migration. Audit your AI-generated codebases for hard-coded cryptographic choices. Implement crypto-agility patterns — abstraction layers that allow algorithm substitution without rewriting application logic. NIST standards are finalized; the migration is a matter of when, not if.

Evaluate AI code liability insurance. The insurance market is still forming, but early movers who can demonstrate AI governance processes are getting coverage. Companies without documented AI security practices will find it increasingly expensive — or impossible — to insure their AI-generated codebases.

Contribute to agent security standards. NIST’s AI Agent Interoperability Profile is expected in Q4 2026. The standards map is being drawn right now. If you’re operating at scale with AI agents, your experience should inform these standards rather than react to them.

The Gap Between Two Top 10 Lists

OWASP now maintains two separate AI security frameworks: the LLM Top 10 (focused on model behavior — prompt injection, training data poisoning, output handling) and the Agentic Top 10 (focused on autonomous action — goal hijacking, tool manipulation, insufficient access control). I covered the top agentic risks in the previous section because that’s where the live threat is. But the gap between these two lists matters more than either list alone.

The LLM Top 10 assumes a human is in the loop — reading the output, deciding whether to act on it. The Agentic Top 10 assumes the AI is acting. Most real-world systems in 2026 sit somewhere in between: semi-autonomous agents that sometimes ask for approval and sometimes don’t, depending on how they were configured. The security model for this middle ground barely exists. The OWASP frameworks address the two endpoints but not the continuum.

This is where the next generation of exploits will live. Attackers won’t target the fully supervised chatbot (low payoff) or the fully autonomous agent (better defended over time). They’ll target the half-supervised agent with unclear boundaries — the one that asks for permission to deploy code but not to modify the deployment configuration. We’ve spent 2025-2026 learning to secure the model’s outputs. We’ll spend 2027-2028 learning to secure the model’s actions. The hardest part will be the systems that do both.

The Arc of This Series

I wrote the first article in this series because the security industry wasn’t keeping up with what was happening on the ground. Developers were building production applications with AI-generated code, shipping them to real users, and nobody was systematically documenting what went wrong — or how to prevent it.

Ten articles later, the picture has changed. When I wrote Part 1, MCP was a protocol most security professionals hadn’t heard of. By Part 9, the NSA had published guidance on it. When I wrote Part 2, mapping OWASP risks to vibe-coded applications was a novel exercise. By mid-2026, OWASP had published separate top 10 lists for both LLM applications and agentic applications. When I wrote Part 4 about supply chain risks, slopsquatting was an emerging research finding. It’s now a documented attack vector with active exploitation in the wild.

The data tells the story. Georgia Tech’s Vibe Security Radar tracked 6 CVEs attributed to AI-generated code in January 2026. By March, it was 35. AI-assisted commits expose hardcoded secrets at 3.2% — more than double the 1.5% baseline rate for human-written code. Apiiro found that AI-generated code creates 322% more privilege escalation paths than human-written code. Developer trust in AI output dropped 11 percentage points in a single year — only 29% now trust AI-generated code, down from 40% in 2024.

The industry isn’t ignoring the problem anymore. What it hasn’t done yet is solve it.

Where We Go from Here

The AI coding assistant market was $7.37 billion in 2025 and is projected to reach $26 billion by 2030. GitHub Copilot alone has approximately 20 million users deployed across 90% of the Fortune 100. This technology isn’t going away. The question was never “should we use AI to write code?” — it was always “how do we do it without burning the house down?”

After ten articles, my answer is the same thing I’d tell any client who asks: the technology is powerful, the risks are real, and the path forward is disciplined engineering, not fear.

Treat AI-generated code as untrusted input — every time, without exception. Build security gates that don’t depend on human vigilance alone. Adopt AI-powered defense tools that can keep pace with AI-generated volume. Prepare for regulation that’s arriving whether you’re ready or not. And invest in the people: the developers who need to understand what the AI gets wrong, the security engineers who need to audit AI-augmented pipelines, and the leaders who need to govern a process that moves faster than any human can review manually.

The vibe coding revolution gave developers extraordinary leverage. The security challenge of the next two years is making that leverage safe to use. At VULNEX, we see this every week — teams shipping fast with AI-generated code, discovering the security debt later, and scrambling to close gaps they didn’t know existed. The tools and frameworks are getting better, but they only work if you adopt them before the breach, not after.

If you’ve been reading this series, I have a request: don’t let it stay theoretical. Pick one item from the roadmap above and implement it this quarter. Audit your MCP server permissions. Set up a 24-hour vulnerability reporting workflow. Run an AI-powered scanner alongside your existing SAST. One concrete step matters more than ten bookmarked articles. And if you find something interesting — a new attack pattern, a tool that works, a regulation gap nobody’s talking about — share it. Tag me. The security community gets stronger when practitioners publish what they learn.

As always: trust nothing, verify everything.

It’s been a privilege writing this series. I hope it’s been useful.

X (Twitter): @SimonRoses

References

European Commission (2024). EU AI Act — Regulation (EU) 2024/1689.
European Commission (2024). Cyber Resilience Act — Regulation (EU) 2024/2847.
The White House (2026). Executive Order on Promoting Advanced AI Innovation and Security.
NIST (2026). AI Agent Standards Initiative — Center for AI Standards and Innovation.
CompTIA (2026). SecAI+ Certification Launch.
Knostic (2026). MCP Server Authentication Audit: Zero out of 2,000 Servers Had Authentication.
Gravitee (2026). State of AI Agent Security 2026.
OWASP (2025). Top 10 for Agentic Applications.
Microsoft (2026). Agent Governance Toolkit.
Google DeepMind (2026). Multi-Agent AI Safety Funding Initiative.
Anthropic (2026). Project Glasswing: Claude Mythos and Coordinated Vulnerability Disclosure.
Chen et al. (2025). IRIS: Neuro-Symbolic Vulnerability Detection with LLMs and Static Analysis.
IEEE S&P (2025). SAST-Genius: Hybrid LLM False Positive Filtering for SAST.
Google DeepMind (2025). CodeMender: Automated Security Fix Generation.
Georgia Tech (2026). Vibe Security Radar: AI-Generated Code CVE Tracking.
Apiiro (2026). AI-Generated Code Creates 322% More Privilege Escalation Paths.
The Geneva Association (2025). AI Risk and Insurance: Challenges and Emerging Responses.
K&L Gates (2026). AI Product Liability: The Next Wave of Litigation.
Carnegie Mellon University (2026). Fake Stars and Manipulated Repositories on GitHub.