Welcome to our blog.

Lovable Partners with Aikido to Bring Pentesting to Vibe-Coded Apps

Lovable and Aikido bring pentesting into the platform, allowing builders to simulate real-world attacks and fix issues before shipping.

Aikido brings pentesting directly into Lovable. Test your app by simulating real attacks and fix issues before you ship.

Product & Company Updates

Madeline Lawrence

CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran

CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran

CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran

Vulnerabilities & Threats

Charlie Eriksen

TeamPCP deploys CanisterWorm on NPM following Trivy compromise

TeamPCP deploys CanisterWorm on NPM following Trivy compromise

TeamPCP deploys CanisterWorm on NPM following Trivy compromise

Vulnerabilities & Threats

Charlie Eriksen

Aikido Recognized by Frost & Sullivan with the 2026 Customer Value Leadership Award in ASPM

Frost & Sullivan recognized Aikido with the 2026 Customer Value Leadership Award in ASPM. We break down what the recognition criteria reveal about how the AppSec market is maturing

Frost & Sullivan recognized Aikido with the 2026 Customer Value Leadership Award in ASPM. We break down what the recognition criteria reveal about how the AppSec market is maturing

News

Michiel Denis

GlassWorm RAT Delivered via Malicious Chrome Extension (Keylogger, Cookie Theft)

GlassWorm deploys a multi-stage RAT that force-installs a malicious Chrome extension to log keystrokes, steal cookies, and exfiltrate data via Solana-based C2.

GlassWorm deploys a multi-stage RAT that force-installs a malicious Chrome extension to log keystrokes, steal cookies, and exfiltrate data via Solana-based C2.

Vulnerabilities & Threats

Ilyas Makari

Why Pentesting Can’t Keep Up: The Speed Problem in Security Testing

Modern teams ship faster than pentesting can keep up. Explore the growing speed gap in security testing—and why traditional approaches are falling behind.

A CISO at a large enterprise told us the most important security capability today is speed. But what happens when testing can’t keep up with how fast systems change?

Guides & Best Practices

Sooraj Shah

fast-draft Open VSX Extension Compromised by BlokTrooper (RAT & Infostealer)

The fast-draft Open VSX extension was compromised to deploy a BlokTrooper RAT and infostealer via GitHub-hosted payloads. Multiple malicious versions identified.

A popular Open VSX extension was compromised and used to deploy a RAT and infostealer from attacker-controlled infrastructure. Its version history tells the real story, with malicious releases appearing between clean ones.

Vulnerabilities & Threats

Raphael Silva

Glassworm Strikes Popular React Native Phone Number Packages in a New Supply Chain Attack

Aikido Security researchers recovered and decrypted the full payload chain from two malicious React Native packages. Here's what the malware does and what to look for.

Two popular React Native npm packages were backdoored by suspected Glassworm actors and used to deliver multi-stage malware. Here's what the malware does and what to look for.

Vulnerabilities & Threats

Raphael Silva

Glassworm Returns: Invisible Unicode Malware Found in 150+ GitHub Repositories

The Glassworm supply chain attack is back. Researchers uncovered malware hidden in invisible Unicode characters across 150+ GitHub repositories, plus npm packages and VS Code extensions.

Glassworm is back with a new wave of invisible Unicode attacks. We’re tracking a fresh campaign quietly compromising repositories across GitHub, npm, and VS Code.

Vulnerabilities & Threats

Ilyas Makari

RSAC 2026 Parties & Security Events Guide | Aikido

RSAC 2026 Parties & Security Events Guide | Aikido

News

Ruben Camerlynck

How Security Teams Fight Back Against AI-Powered Hackers

AI has lowered the bar for hackers dramatically. Here's what that means for defenders and how continuous AI pentesting changes the equation.

A single hacker and a Claude subscription just took down nine Mexican government agencies. AI has handed attackers a serious power upgrade. Security teams need a new playbook.

Vulnerabilities & Threats

Dania Durnas

Betterleaks: The Gitleaks Successor Built for Faster Secrets Scanning

Betterleaks is a new open source secrets scanner from the creator of Gitleaks. A drop-in replacement with faster scans, token efficiency detection, configurable validation, and more.

The creator of Gitleaks is launching its successor. Betterleaks is a faster open source secrets scanner built to catch more leaks and fit modern developer workflows.

Product & Company Updates

Zach Rice

How does AI Pentesting Work with Compliance?

AI pentesting is being accepted for SOC 2, ISO 27001, HIPAA, and PCI DSS. Here's what auditors actually look for, and where the real limitations are.

AI pentesting is being accepted for SOC 2, ISO 27001, HIPAA, and PCI DSS. Here's what auditors actually look for, and where the real limitations are.

Compliance

Dania Durnas

Trump’s 2026 Cybersecurity Strategy: From Compliance to Consequence

The Trump administration’s 2026 cybersecurity strategy shifts the focus from compliance checklists to real consequences for cybercriminals. Here’s what CISOs need to know.

News

Mike Wilkes

Continuous pentesting: how it works and what it requires

Continuous pentesting promises real-time security validation, but most implementations fall short. Here’s what continuous pentesting actually requires—from change-aware testing to exploit validation and remediation loops.

Continuous pentesting is widely discussed, but rarely defined clearly. This piece breaks down what it is, what it isn’t, and what it actually requires.

Guides & Best Practices

Sooraj Shah

Rare Not Random: Using Token Efficiency for Secrets Scanning

Entropy often struggles with generic secrets and short strings. We look at how token efficiency can better identify strings that don’t look like normal text.

Entropy is great at spotting randomness. But secrets aren’t always random. They’re just strings that don’t show up in normal code or text. We explore using BPE tokenization to measure that difference.

Guides & Best Practices

Zach Rice

Why Determinism Is Still a Necessity in Security

AI scanning finds what rules miss. Deterministic scanning finds it every time. Here's why the best security pipelines don't choose between them.

AI-powered security tools are getting better at finding vulnerabilities. But deterministic tools give you the consistency that pipelines, compliance, and audit trails depend on. We look at what deterministic scanning does well, where AI takes over, and how the two work together for effective security.

Engineering

Dania Durnas

WAF vs. RASP vs. ADR: How Runtime Application Security Works

WAF, RASP, and ADR protect your app in completely different ways. Here's what each layer actually does, where it falls short, and which ones you need.

WAF, RASP, ADR, eBPF — We're clearing up the terminology around runtime application security. Here's what each layer actually does, how they overlap, and how they fit together

Guides

Dania Durnas

Aikido Infinite: Continuous AI Pentesting for Every Release

Aikido Infinite runs AI penetration testing on every code change, validates exploitability, generates patches, and retests fixes before code hits production, making self-securing software a reality.

Aikido

Madeline Lawrence

Persistent XSS/RCE using WebSockets in Storybook (CVE-2026-27148)

CVE-2026-27148 exposes a WebSocket hijacking flaw in Storybook that can escalate into supply chain compromise. Learn the attack path, impact, and how to remediate.

Aikido Attack found a WebSocket hijacking vulnerability in Storybook's dev server that can lead to persistent XSS, remote code execution, and, in the worst case, supply chain compromise. We walk through how an attacker can exploit this without any user interaction at all, and a developer just has to visit the wrong website while to run into this attack.

Vulnerabilities & Threats

Robbe Verwilghen

How Aikido Secures AI Pentesting Agents and Prevents Scope Drift

Learn how Aikido secures AI pentesting agents with architectural isolation, runtime scope enforcement, and network-level controls to prevent production drift and data leakage.

AI agents are built to explore. In cybersecurity, that exploration needs strict boundaries. This article explains how Aikido secures AI pentesting agents through architectural isolation, runtime scope enforcement, and layered controls that contain risk by design.

Product & Company Updates

Sooraj Shah

Astro SSRF Vulnerability: Host Header Injection in SSR Error Pages (CVE-2026-25545)

Aikido Security's AI pentesting agent discovered a Server-Side Request Forgery vulnerability in Astro's SSR implementation. Learn how Host header injection in prerendered error pages allowed full internal network access.

Aikido's AI pentesting agent discovered an SSRF vulnerability in Astro's Node.js adapter. We'll look at how by injecting a malicious Host: header, attackers could redirect an internal request to any URL on the local network.

Vulnerabilities & Threats

Jorian Woltjer

How to Get Your Board to Care About Security Before a Breach

Boards don’t fund security because it’s important. They fund defensible decisions. Here’s how to frame risk, reduce ambiguity, and win real support before a breach forces the issue.

Guides

Mike Wilkes

Slopsquatting: The AI Package Hallucination Attack Already Happening

AI models hallucinate npm package names. Attackers register them first. Here's what slopsquatting is, how it's spreading through agent skills, and how to protect yourself.

AI models hallucinate package names — and attackers are registering them before anyone notices. Slopsquatting is the AI-era evolution of typosquatting, and unlike its predecessor, npm's existing protections don't work. We look at the real-world research showing it's already happening, from confirmed malicious packages still pulling hundreds of weekly downloads to a hallucinated package name that spread to 237 repositories through AI agent skill files.

Guides & Best Practices

Dania Durnas

Wiz Code Alternatives (2026): 6 Tools Compared and Best Developer-First Option

Looking for Wiz Code alternatives? Compare 6 tools across SAST, DAST, SCA, pricing, and developer experience to find the best AppSec platform for 2026.

This guide compares Wiz Code against six alternatives: Aikido Security, Snyk, Checkmarx, GitHub Advanced Security, Mend, and Veracode, evaluated on coverage, developer experience, AI-powered triage, pricing transparency, and deployment speed. Aikido Security comes out on top for teams wanting a developer-first platform with broad coverage, 85% false positive reduction, AI AutoFix across SAST, IaC and containers, native DAST, and transparent pricing at roughly one-tenth the cost of Wiz.

Guides & Best Practices

Dania Durnas