Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Somewhere in your IT team, there's probably a PowerShell script that only one person understands. It creates accounts for new hires, assigns groups, and maybe disables users when someone leaves. And everyone's afraid to touch it. Alongside it, there is usually a spreadsheet of who needs what, a service-desk queue full of access requests, and a transfer request waiting in a manager’s inbox. Joiner-mover-leaver automation (JML automation) replaces that patchwork with a single, policy-driven workflow.

If your team runs gem install or bundle install, on laptops or in CI, this post is for you. It’s the kind of thing you’d never expect. A gem can run code on your machine without an install script. Here’s how to check for four data-exfiltrating gems we found on RubyGems, turn this behavior off with new settings, and see what Aikido flags in your feed.

tl;dr If you leak a secret, rotate it immediately. Deleting a file, rewriting git commit history or deleting your repository won't protect you. Attackers routinely scan the internet for secrets, so assume they already have a copy. Use Betterleaks or Aikido Secrets Detection to find leaked secrets in your repos, and Aikido Device Protection to find them on developer machines. In May, LiteLLM developers accidentally committed an administrative key to a public GitHub repository.

Many enterprises are treating the EU AI Act like a compliance checkbox. Tick the box and move on. But Article 4 has been enforceable since August 2, 2026: is your technical team aware of AI vulnerabilities and attack classes? Can they identify these attacks? The EU AI Act asks two things of your team: do your staff actually understand AI threats (Article 4), and can your high-risk AI actually resist them (Article 15)? Those are capability questions, and capability is built, not filed.

AI apps and agents are proliferating across enterprise endpoint environments as desktop apps, coding tools, and browser sessions. As I meet with CISOs and other security leaders, I consistently hear concern about the risk of AI agents accessing and exfiltrating sensitive data as well as performing harmful actions, maliciously or by mistake. But saying no to AI isn't an option. Employees want to use tools like Claude Cowork, Codex, and browser AI apps, and the challenge is how to allow that safely.