Developers love AI coding tools. And why wouldn’t they? After all, they write code faster. They reduce repetitive work. They help junior engineers ship features that used to take days. But there’s a problem no one wants to talk about at the planning meeting. AI coding tools are producing insecure code at massive scale. And the industry is running out of time to fix it.

The Mini Shai-Hulud supply chain campaign has resurfaced with its largest wave yet. Over a 48-hour window on May 11-12, 2026, attackers compromised 172 unique packages across 403 malicious versions on npm and PyPI, including high-profile scopes like @tanstack, @uipath, @mistralai, and @opensearch-project.

A platform team finishes a two-week observation window on a new internal research agent. The baseline is stable; the sensor produced a clean profile. By Friday, no policy has shipped — and the blocker isn’t tooling.

Your database crashes at 2 PM, but your last backup ran at midnight. That’s 14 hours of lost transactions, customer records, and operational data. The gap between your last usable backup and the moment disaster strikes is exactly what the recovery point objective (RPO) defines. Most organizations don’t think seriously about it until they’re already staring at the damage. RPO in disaster recovery planning determines whether you lose five minutes of data or five days of it.

A board committee charter is more than governance paperwork; it’s the rulebook that keeps the board’s engine humming when pressure rises and complexity grows. At its best, a charter makes responsibilities visible, removes guesswork, and creates a predictable rhythm for oversight so directors and management spend less time arguing about who should do what and more time solving the right problems.

AI desktop assistants and coding tools need credentials to reach external services, and many of them store those credentials as plaintext JSON at predictable paths in the user's home directory. This research covers how credential storage works across 14 popular AI tools, where OS keychain integration is present or missing, and eight attack scenarios that turn that exposure into real risk, from malware-based theft to remote session hijacking to supply-chain compromise via MCP servers.

The Model Context Protocol (MCP) is a de facto standard for providing structured access to privileged systems for AI agents and external integrations. It acts as a USB-C port for AI, enabling faster innovation by allowing organizations to expose tools, resources, and workflows without the time-consuming work of building APIs. Adoption has surged in recent months, and categories like payments, project management, and developer platforms are already beginning to reap the benefits.

The Tines Voice of Security 2026 report found that security professionals spend 44% of their time on manual, repetitive work. A workflow engine is the software built to take that operational drag off people, deciding what happens next based on events, rules, and state. The category is shifting. The workflow engine used to live inside one system, running a narrow set of backend steps.

Mobile devices are becoming the highest‑trusted endpoints that are the least protected. Phones sit between your people and your most important systems: identity, email, collaboration, and cloud apps. They’re also where modern social engineers are turning their attention, leveraging SMS and messaging services, QR codes, and email-based attack vectors to harvest credentials.