Blog
research findings

research findings

by Tamir Isaschar

The Source Looked Clean. The Binary Wasn't.

Sample api-reactor.vsix — NoahBit.api-reactor v0.0.1 SHA-256 ca272b481f630635cd059f85321dbc7be372e75820536ccbfd29dfcf571ab45c Publisher NoahBit (GitHu...

29 June 2026

research findings AI data security

by Tamir Isaschar

Revoking Your Token Won't Save You: The VS Code Attack That Installs a Permanent GitHub Backdoor

The Attack That Survives Your Response When a developer discovers a compromised VS Code extension, t...

by Knostic Team

SaassyCode Post-Disclosure Wave: Five New Extensions, 32,000+ Total Installs

Previous post:Update and Infect: How the SaassyCode Campaign Grew from Two Extensions to Nineteen →

by Knostic Team

Update and Infect: How the SaassyCode Campaign Grew from Two Extensions to Nineteen

by Gadi Evron

New VS Code extensions attack campaign: SaassyCode - ManageRBLX & TrelloBlox

Background An active VS Code extensions attack campaign we dub SaassyCode, is currently targeting us...

by Gadi Evron

GitHub Supply Chain Breach: Nx Console 18.95.0 (Analysis)

💡 If you're looking to prevent a threat like this from happening, check out Kirin, our solution for...

by Gadi Evron

Agentic Threat Intelligence Feed - VS Code Extensions

💡 If you're looking to prevent a threat like this from happening, check out Kirin, our solution for...

AI Safety vs. AI Security: Explaining the Differences

by Knostic Team

AI Safety vs. AI Security: Explaining the Differences

Somewhere between hype decks and regulatory memos, "AI safety" and "AI security" started getting use...

Cursor and Claude Code's automatic loading of .env files containing secrets

by Knostic Team

From .env to Leakage: Mishandling of Secrets by Coding Agents

AI coding assistants churn out insecure code, but a less-discussed issue is their handling of secret...

by Knostic Team

First Large-Scale AI-Orchestrated Cyber Espionage Campaign

Anthropic released research in November 2025 documenting the first reported case of a large-scale AI...

The Source Looked Clean. The Binary Wasn't.

OpenAnt: Read the LLM Vulnerability Paper

Revoking Your Token Won't Save You: The VS Code Attack That Installs a Permanent GitHub Backdoor

Knostic Featured Across Three Categories in CSA's Agentic AI Security Innovator Market Map

Knostic Research Team Blog

Browse Blog Categories

research findings

The Source Looked Clean. The Binary Wasn't.

Revoking Your Token Won't Save You: The VS Code Attack That Installs a Permanent GitHub Backdoor

SaassyCode Post-Disclosure Wave: Five New Extensions, 32,000+ Total Installs

Update and Infect: How the SaassyCode Campaign Grew from Two Extensions to Nineteen

New VS Code extensions attack campaign: SaassyCode - ManageRBLX & TrelloBlox

GitHub Supply Chain Breach: Nx Console 18.95.0 (Analysis)

Agentic Threat Intelligence Feed - VS Code Extensions

AI Safety vs. AI Security: Explaining the Differences

From .env to Leakage: Mishandling of Secrets by Coding Agents

First Large-Scale AI-Orchestrated Cyber Espionage Campaign

Schedule a demo to see what Knostic can do for you

Become Our Partner

Free Tools

Industry Solutions

Policies and Legal

Resources

Departments

Roles

Become Our Partner

Knostic Research Team Blog

Browse Blog Categories

research findings

Read other posts

Schedule a demo to see what Knostic can do for you

Become Our Partner

Free Tools

Industry Solutions

Policies and Legal

Resources

Departments

Roles

STAY AHEAD IN AI RISK & COMPLIANCE

EXPLORE KNOSTIC

Free Tools

Solutions by Department

Solutions by Role

Solutions by Industry

Resources

COMPANY

Become Our Partner