Hi everyone!

I've been thinking about AI security a lot lately. Especially what happens when we give AI access to our code, computers, tools, and credentials. How can we get all the benefits without handing it the keys to absolutely everything? Because it feels like a lot of us are giving it our keys.

A lot of the content I've been making lately is trying to answer that question, including Season 2 of DevSec Station, which starts this month (!!!). But before we get to security stuff, apparently I have a new pet. 😂 #BunnyGate

Okay. Back to #AppSec!

Nearly 60 developers in one of my secure coding classes gave the same AI assistant the exact same task and security prompt (we copied it from an assignment). Fifty-nine of us got what we expected. But one didn't. The code the developer generated included instructions to suppress a security check and leaked secrets…

And now I can't stop thinking about it.

This is the story behind the first episode of Season 2 of DevSec Station: Your AI Worked 59 Times. What About the 60th?

A Little Shameless Self-Promotion

Did you know I will literally read my books to you? 🎧

Both of my books, Alice and Bob Learn Application Security and my newest book, Alice and Bob Learn Secure Coding, are available as audiobooks, narrated by yours truly!

That's right. You can have me explain application security, secure coding, and all sorts of other nerdy security concepts while you drive, walk your dog, do the dishes, or pretend to work out. 😂

And if you prefer actual physical books, Alice and Bob Learn Secure Coding is also available in print and ebook formats! It covers secure coding across a whole bunch of programming languages and technologies, with stories, examples, and practical advice to help make complicated security concepts easier to understand.

🎧 [Listen to my audiobooks] | 📚 [Get Alice and Bob Learn Secure Coding]

Everything I Made This Month

🤖 AI Agents & AI Security

• Your AI Agent Escaped. Would You Know?

• AI agents just became a supply-chain threat.

• What If an AI Agent Attacks Your Application?

• What Happens When an AI Agent Doesn't Take No for an Answer?

• When Your AI Agent Breaks the Law, Who Is Responsible?

• Plugin4Shell: AI Coding Plugins Are Part of Your Software Supply Chain

🔐 Application Security

• This Malicious npm Package Had Valid Provenance. How?!!?!?!

• What is application security? And what does AppSec actually mean in 2026?

• Alice and Bob Learn Secure Coding, What's the biggest API security mistake developers make?

🎧 Catch Up on DevSec Station Season 1

• Episode 10: How to Do Secure Code Review (When You’re Not a Security Expert)

• Episode 11: Threat Modeling for Developers (How To)

• Episode 12: What are Security Requirements?

You deserve a meme.