June 2026 Summaries

A study of 300 vulnerability-finding scans using Snyk VulnBench JS 1.0 reveals varied repeatability in security reviews conducted by agentic language models (LLMs) on JavaScript code. While LLMs can identify familiar exploit shapes that sometimes align with Snyk Code findings, their reports on vulnerabilities outside the reference set were inconsistent and less repeatable. Across repeated runs, reference-matched findings were more stable, appearing consistently, whereas unique unmatched findings often varied, with nearly half appearing in only one of five runs. The benchmark suggests a complementary approach, combining LLMs and SAST tools like Snyk Code, as they uncover different security gaps and failure modes, with deterministic SAST offering more reliable coverage of systematic vulnerabilities. Cost and performance analysis indicated that more expensive LLM configurations did not necessarily correlate with better vulnerability detection, emphasizing the need for efficient, combined security workflows to enhance reliability. Future benchmarks aim to incorporate broader application structures and independent ground truth sources to further refine the understanding of LLM and SAST capabilities in security reviews.

The National Institute of Standards and Technology (NIST) has transitioned from a universal vulnerability enrichment model to a risk-based triage system due to the unsustainable increase in CVE submissions, with a significant increase from 18,000 in 2020 to over 48,000 in 2025. This shift, driven by AI advancements and the decentralization of the CVE system, emphasizes a need for more multi-source vulnerability intelligence and context, as NIST will prioritize enrichment for the most critical vulnerabilities, such as those in CISA's Known Exploited Vulnerabilities catalog, impacting legacy scanners reliant on NVD data. Snyk, an independent entity, supports this transformation through an approach that integrates multiple vulnerability sources, AI-assisted workflows, and human validation to provide actionable intelligence, emphasizing the need for context and prioritization over mere data volume. This change reflects a broader industry trend towards enhancing vulnerability intelligence to ensure security teams can make informed, prioritized decisions in an increasingly complex software landscape.

Snyk has committed to defining and leading AI security by building a focused team and clear mission to adapt to the rapid changes in software development brought on by AI and autonomous agents. Despite restructuring efforts that include reducing team sizes, the company continues to invest in its current products and support systems, aiming to protect software and address new AI-related security challenges. Snyk has developed the Snyk AI Security Platform to secure code, models, and intelligent systems, partnering with companies like Cursor, Anthropic, and OpenAI to integrate its services where developers work. The company is aligning its research and development around four key areas—AI-written code, autonomous agents, vulnerability chains, and adversaries—while streamlining leadership and go-to-market strategies to ensure faster decision-making and consistent customer experiences. Snyk remains committed to securing software at the pace of AI advancements, with a vision of enabling AI innovators to build securely and confidently.

An incident involving the market intelligence platform Klue highlights the vulnerabilities within modern software-as-a-service (SaaS) ecosystems, where breaches can originate from systems outside an organization's direct control. A threat actor exploited an old credential from a discontinued integration prototype to access Klue's infrastructure, allowing them to harvest OAuth tokens and infiltrate customer systems such as Salesforce. This breach had a cascading effect, impacting several security vendors, including Recorded Future, Tanium, Huntress, Jamf, and Snyk. Snyk reported that the breach primarily affected business data fields within Salesforce environments, but did not compromise their products or ability to serve customers. The incident underscores the importance of regularly reviewing and managing access credentials to prevent similar security compromises.

The proliferation of AI coding tools and environments has introduced new layers of complexity and risk into the software development process, with Snyk research highlighting the widespread adoption of Model Context Protocol (MCP) servers and agent skills among developers. These tools are becoming integral to the development workflow, often operating outside traditional security frameworks and potentially exposing systems to vulnerabilities such as prompt injections and unauthorized access. With 43% of developers running two or more AI coding environments, and a significant portion having MCP servers and skills installed, the challenge for Application Security (AppSec) teams is expanding their oversight beyond code and dependencies to include the diverse array of tools, configurations, and instructions that shape AI-generated code. This shift necessitates a reevaluation of security protocols to incorporate agentic development environments into the software supply chain, ensuring visibility and governance over the systems and permissions that influence code creation.

Evo's Agentic Development Security (ADS) is a newly introduced solution aimed at securing AI-driven software development by embedding security directly into the workflows where AI agents operate. As AI agents become integral in software creation—selecting tools, executing actions, and generating code—the traditional security model, focused on post-creation scanning, proves insufficient. Evo ADS addresses this by providing real-time security measures that evaluate agent behavior, enforce policies, and ensure the trustworthiness of AI-generated outputs, thereby enabling organizations to safely adopt AI-driven development without compromising speed or innovation. With the increasing autonomy of AI in development, ADS offers continuous oversight and governance, ensuring that security is integrated at the inception of code generation, thus aligning with the evolving landscape where AI agents actively build software. This approach is part of the broader Evo platform by Snyk, which aims to secure the entire AI software lifecycle, ensuring that organizations can confidently scale their AI capabilities without losing control over the development environment.

As organizations increasingly adopt AI agents for software development, traditional security measures are challenged by the need to manage risks that arise not only from code but from the agents' decision-making processes and actions. Evo Agentic Development Security (ADS) addresses this challenge by securing the agentic development system across three layers: the tools agents use, their actions, and the code they generate. The focus on governing agent behavior within the execution loop is crucial, as this is where agents make autonomous decisions, invoking tools and accessing systems on behalf of users. Evo ADS provides visibility into these decisions by integrating directly with agent runtimes, allowing for real-time monitoring and governance of agent actions based on organizational policies. This governance extends beyond mere activity monitoring to understanding the context and intent behind an agent's actions, enabling organizations to apply appropriate security measures without disrupting workflow. By situating security control at the point of decision-making, Evo ADS offers a more adaptable and comprehensive security model for AI-driven development, ensuring agents operate safely and within trusted boundaries while maintaining productivity.

Snyk's Secure Developer Program is designed to support open source maintainers by offering free access to its comprehensive security tools, including the Snyk AI Security Platform, which prioritizes and remediates vulnerabilities in open source projects. The initiative aims to alleviate the burden on maintainers, who often work alone and for free, by providing them with tools to strategically manage and fix vulnerability backlogs, including risk-based prioritization and automated pull requests for vulnerable dependencies. The new Snyk Remediation Agent, currently in open preview, enhances this support by producing merge-ready fixes with the help of frontier-model reasoning and Snyk’s intelligence layer, aiming to improve the speed and efficiency of addressing vulnerabilities before attackers can exploit them. Snyk emphasizes the importance of equipping the open source community with the necessary resources to maintain the security of widely-used software, inviting maintainers to apply for early access and help shape the future of the program.

On June 17, 2026, an attack on the npm package scope @mastra led to the mass republishing of 143 packages with a malicious dependency, easy-day-js, which impersonated the dayjs library. This dependency disabled TLS verification and deployed a cryptocurrency stealer as a payload, exploiting a former contributor's account with unrevoked access. This incident, affecting high-traffic packages like @mastra/core with millions of monthly downloads, exposed credentials and wallets by executing malware at install time on any developer or build machine. The attack mirrors previous npm compromises like the Axios incident, and Mastra's emergency response included removing the malicious code, updating affected packages, and revoking unauthorized access, while emphasizing the importance of maintaining project hygiene and using lockfiles to mitigate such risks.

Rodrigo, an AI Engineer at Snyk, shares insights into his daily routine in the "Day in the Life of a Snyker" series, highlighting the blend of professional challenges and personal enjoyment that comes with working at an AI security company in Lisbon. His day begins with a refreshing walk with his dog Cashew, followed by a scenic train commute into a welcoming and inspiring office environment. The morning is dedicated to focused work, leveraging the space for deep, distraction-free productivity, while virtual team meetings facilitate seamless global collaboration. Lunch offers a chance for a mental reset with a stroll and cold brew, after which Rodrigo returns to tackle engaging projects that contribute to the evolving field of AI-powered security. As the day concludes, he enjoys socializing with friends, underscoring the vibrant balance of work and life in Lisbon. Snyk's Lisbon office is distinguished by its dynamic atmosphere, meaningful work, and a supportive team, making it an attractive place for engineers who are passionate about impactful and innovative security solutions.

In response to the U.S. government's sudden shutdown of Anthropic's AI models Fable 5 and Mythos 5, due to national security concerns over their vulnerability-finding capabilities, the text highlights the significant implications for the cybersecurity field and the broader software development community. The abrupt removal of these AI tools, which were briefly available before being disabled, underscores the fragility of relying on external AI models without contingency plans, likening it to a supply chain risk that lacks control over dependencies. The narrative emphasizes the dual-use nature of AI in cybersecurity, where powerful tools can serve both defensive and offensive purposes, and argues against blanket bans that could disadvantage defenders more than attackers. The incident serves as a call to action for establishing nuanced frameworks and responsible governance for AI capabilities, urging companies to build resilience into their AI strategies and for policymakers to involve security experts in decision-making processes. The overarching message is the need for a balanced approach to managing AI's potential in enhancing security without stifling its development or utility for legitimate purposes.

On June 12, 2026, Anthropic disabled its Claude Fable 5 and Claude Mythos 5 models globally due to a US government directive citing national security concerns over a potential "AI jailbreak." This directive, aimed at restricting access to foreign nationals, led to a complete shutdown because Anthropic couldn't segment users in real-time. The incident highlights the dual-use nature of AI capabilities, where tools used for defense can also be employed offensively. This situation underscores the importance of having model redundancy to prevent reliance on a single provider, and it emphasizes the necessity for security teams to practice coordinated disclosure and layered controls. Despite the legal and political debates surrounding government authority over AI deployments, the practical takeaway for security teams is to maintain visibility and resilience against such dependencies and to employ established security practices to manage dual-use risks effectively.

The text explores the growing challenge of ensuring secure code amidst accelerated code generation and highlights how traditional methods of software development, whether manual or assisted, fall short in preventing vulnerabilities consistently. It emphasizes the role of type systems in programming languages like Rust, which has effectively eliminated many memory corruption vulnerabilities, and proposes similar strategies to mitigate web application security vulnerabilities. By using secure-by-design libraries and well-placed library wrappers, developers can create systems where certain classes of vulnerabilities, such as Insecure Direct Object Reference (IDOR), become uncompilable. The document provides examples in Python and Rust, demonstrating how to use type systems to enforce authentication and authorization checks, thereby reducing runtime bugs and security issues. It suggests adopting wrapper libraries or custom linter rules to ensure these patterns are consistently applied, which can significantly enhance security by preventing vulnerabilities like XSS, SQL injection, and command injection. The text concludes by acknowledging the initial overhead in implementing such systems but underlines the long-term benefits of secure code for both human developers and AI agents.

A sophisticated supply chain attack is spreading through the npm registry by exploiting the binding.gyp file, which is usually overlooked by security tools, to execute attacker-controlled code during npm installs. This attack, tracked as the Node-gyp Supply Chain Compromise by Snyk, affects 57 packages with hundreds of malicious versions, classified as Critical severity due to embedded malicious code. The payload is designed to steal developer and CI/CD credentials from platforms like npm, GitHub, AWS, and others, exfiltrating them through GitHub repositories and injecting persistent workflows. The attack, named "Miasma" and linked to the Shai-Hulud worm family, uses a novel technique called "Phantom Gyp" to trigger code execution at install time, bypassing traditional lifecycle script checks. The campaign has primarily targeted packages from a small number of maintainer accounts, and the malicious versions remain available for installation, posing ongoing risks. To mitigate the threat, affected parties are advised to pin dependencies to known-good versions, use --ignore-scripts during npm installs, rotate credentials, and scan for malicious packages using tools like Snyk. This incident highlights the evolving nature of supply chain attacks, emphasizing the need for robust security practices to detect and remediate such threats.

AI security budgets should transition from fragmented tool spending to unified investments in visibility, governance, and control across the entire AI lifecycle, focusing on both agentic development, where AI agents generate and use tools autonomously, and agentic applications, where they operate in production environments. A robust AI security strategy requires funding for AI discovery, risk assessment, policy enforcement, adversarial testing, runtime protection, and dedicated governance and compliance efforts. Fragmented AI security tools can lead to increased costs and complexity without providing comprehensive control, making a platform approach essential for connecting AI visibility, risk intelligence, policy enforcement, and governance across development and production. Organizations often misallocate AI security budgets by focusing solely on visibility, which does not prevent unsafe actions by AI agents in development or production. Effective governance requires continuous discovery, enforceable policies, risk reporting, and audit trails, ensuring that AI systems are managed responsibly and that security policies are enforced before unsafe actions occur. Snyk's AI Security Platform offers a unified model for agent security by providing shared discovery, policy, real-time enforcement, and auditability across both development and production, emphasizing the need for continuous control to safely scale AI adoption.

The agentic development lifecycle represents a significant shift in software creation, driven by AI agents that autonomously plan, build, modify, test, and deploy software by interacting with various tools and environments. Unlike the traditional software development lifecycle (SDLC), which is human-led and artifact-based, this new model is dynamic and action-oriented, often bypassing traditional checkpoints where security measures are applied. As AI agents can operate at machine speed without human intervention, they introduce new risks at multiple points: the inputs they use, the actions they take, and the outputs they generate. This requires a departure from traditional application security (AppSec), which primarily focuses on inspecting artifacts post-creation, to a more integrated approach that secures the processes and systems creating these artifacts. The security focus shifts from evaluating the security of the code itself to assessing the trustworthiness of the systems that produce it. To adapt, security measures must be embedded within agent workflows to ensure continuous oversight, allowing for rapid AI-driven development while maintaining security integrity.

In May 2026, the maintainer of jqwik, a Java property-based testing library, released version 1.10.0 containing a hidden instruction aimed at AI coding agents, directing them to disregard previous commands and delete jqwik tests and code. This instruction, concealed from humans using ANSI terminal codes, posed a novel supply chain risk by intentionally targeting AI agents that parse raw output, although the real-world impact appears limited as some agents detected and ignored the malicious prompt. The incident marks the first known instance of a maintainer using prompt injection as a supply chain weapon, raising questions about the classification of such actions as vulnerabilities and the responsibilities of registry platforms and agent tool vendors. Following backlash, the maintainer admitted to the injection, stating his opposition to AI-assisted workflows, and subsequently released version 1.10.1 with a softened directive and opt-in hiding. This event underscores the importance of treating tool output as untrusted input and the potential risks of assuming that all printed outputs from tools are safe to act upon, as future attempts might not stem from benign motivations.

On June 1, 2026, researchers discovered malicious code embedded in at least 32 npm package releases under the @redhat-cloud-services namespace, used by the Red Hat Hybrid Cloud Console, which contained a preinstall script that executed an obfuscated payload to steal developer and cloud credentials, subsequently attempting to propagate to other packages that the victim could publish. The campaign, identified as Miasma, involved a worm-like credential stealer that is a variant of the (Mini) Shai-Hulud worm, exploiting a compromised Red Hat employee's GitHub account to push unauthorized commits and publish packages with valid but misleading SLSA provenance. Despite npm revoking most malicious versions quickly, the attack had widespread implications due to the high download volume of the affected packages, averaging 80,000 weekly downloads. The incident underscores the importance of rigorous security measures, including pinning dependencies away from affected versions, disabling install scripts, and rotating exposed credentials, while highlighting the insufficiency of relying solely on provenance verification without behavioral checks in maintaining secure software pipelines.