GitHub says hackers stole about 3,800 internal repos after a poisoned VS Code extension hit an employee device ...

Researchers say prompt injection attacks could manipulate AI coding agents to access sensitive credentials stored in software ...

A Claude Code GitHub Action flaw let one malicious issue hijack repositories via prompt injection. Anthropic has patched it.

Miasma hit 73 Microsoft repos across four GitHub orgs, forcing access disablement and exposing open-source trust risks.

A flaw in Claude Code's GitHub Action let attackers bypass permission checks via fake bots and steal OIDC tokens through prompt injection.

Microsoft is discontinuing most internal Claude Code licenses by June 30, directing engineers to its own GitHub Copilot CLI.

Its disclosure raises questions about what security researchers should expect from vendors, and how far in advance of its ...

Dozens of cryptographically verified open source packages from Microsoft were compromised late last week to add advanced credential-stealing code that was triggered when developers opened them in AI ...

The smartest way to use AI may not be letting it touch your files, but asking it to write software that handles them safely - ...

VS Code flaw exposes GitHub OAuth tokens via one-click attack on GitHub.dev, enabling private repo access and token theft.

GitHub Copilot multi-agent support for VS Code launched at Microsoft Build 2026 alongside Project Polaris, an in-house AI ...

A VS Code vulnerability in GitHub.dev lets attackers steal full GitHub OAuth tokens via a single malicious link, exposing all private repositories.