by Knostic Team

From .env to Leakage: Mishandling of Secrets by Coding Agents

AI coding assistants churn out insecure code, but a less-discussed issue is their handling of secret...

16 December 2025

research findings

by Knostic Team

First Large-Scale AI-Orchestrated Cyber Espionage Campaign

Anthropic released research in November 2025 documenting the first reported case of a large-scale AI...

18 November 2025

research findings

by Dor Munis

MCP Hijacking of Cursor’s New Browser

We walk through how Cursor’s new browser could be compromised via JavaScript injection. Unlike VS Co...

13 November 2025

research findings

by Knostic Team

Deep Dive: Cursor Code Injection Runtime Attacks

A JavaScript injection attack on Cursor, facilitated by a malicious extension, can take over the IDE...

5 November 2025

research findings

by Knostic Team

Detecting GlassWorm with YARA Rules

We’ve published YARA signatures to detect GlassWorm, a self-propagating worm first reported by Koi S...

27 October 2025

research findings

by Knostic Team

Zero Width Unicode Characters: the Risks you Can't See

Developers read what they see, but not everything in code is visible. Zero-width Unicode characters,...

21 October 2025

research findings

by Knostic Team

Primer: How to Spot and Analyze Malicious VS Code Extensions

Practical methods to identify, inspect, and defend against compromised IDE extensions that turn deve...

19 October 2025

research findings

by Knostic Team

Open Marketplaces: The Good, the Bad, and The Dangerous

Compromised extensions remain public even after exposure, showing how open marketplaces can be abuse...

19 October 2025

research findings

by Knostic Team

New Malware, New Problems for IDEs and AI Coding Agents

A new malware campaign shows how vulnerable IDEs and AI coding agents have become as part of today’s...

19 October 2025

research findings