Toni Antunovic

Toni Antunovic

May 23

Transitive Prompt Injection in Multi-Agent Coding Pipelines: One Poisoned Tool, Every Downstream Agent

#promptinjection #multiagentai #agenticsecurity #claudecode

9 min read

Toni Antunovic

May 21

Slopsquatting: The Attacker Playbook for AI-Hallucinated Package Names

#slopsquatting #supplychainsecurity #aicodingagents #npmsecurity

1

10 min read

Toni Antunovic

May 19

When Every PR Is a Rubber Stamp: What Automated Gates Catch That Exhausted Reviewers Miss

#codereview #devsecops #aitools #productivity

8 min read

Toni Antunovic

May 16

Clinejection: When Your AI Coding Tool Became the Weapon

#promptinjection #supplychainsecurity #devsecops #githubactions

1

9 min read

Toni Antunovic

May 14

CLAUDE.md Is a Security Boundary

#security #claudecode #devsecops #configsecurity

2

7 min read

Toni Antunovic

May 14

What LucidShark Would Have Caught Before the TanStack Attack Landed

#supplychainsecurity #sca #tanstack #devsecops

7 min read

Toni Antunovic

May 12

Approve Once, Exploit Forever: The Trust Persistence Vulnerability Vendors Will Not Fix

#security #claudecode #devsecops #supplychain

1

6 min read

Toni Antunovic

May 12

How to Review Code Your AI Agent Wrote While You Were Sleeping

#aiagents #codereview #devsecops #codequality

7 min read

Toni Antunovic

May 7

The Georgia Tech CVE Data Shows AI Code Tools Have a Volume Problem

#security #webdev #ai #programming

1

7 min read

Toni Antunovic

May 5

The Co-Authored-By Copilot Controversy Misses the Real Problem

#aicodereview #githubcopilot #codequality #sast

1

6 min read

Toni Antunovic

May 2

CVE-2026-26268: How Cloning a Repo Can Now Execute Attacker Code in Your AI IDE

#security #cursor #git #devsecops

10

6 min read

Toni Antunovic

Apr 30

The MCP RCE That Anthropic Won't Patch: Your Enforcement Checklist

#security #mcp #devops #agentic

2

1

6 min read

Toni Antunovic

Apr 29

572K Weekly Downloads, One Preinstall Script: The SAP CAP Supply Chain Attack Your AI Agent Would Have Missed

#security #npm #supplychain #devops

1

3 min read

Toni Antunovic

Apr 28

When Your AI Coding Tool Disappears Overnight: The Case for Provider-Agnostic Quality Gates

#claudecode #devtools #aicode #qualitygate

1

6 min read

Toni Antunovic

Apr 28

AI Hallucinated Dependencies Are the New Supply Chain Attack: How to Stop Them

#supplychainsecurity #aicode #npm #security

8 min read

Toni Antunovic

Apr 18

AI Agents Generate Code That Passes Your Tests. That Is the Problem.

#testing #ai #codequality #devops

9

6

6 min read

Toni Antunovic

Apr 16

Project Glasswing Found 35 CVEs in March. Here Is the Quality Gate You Need Before AI Agents Touch Your Codebase.

#security #devsecops #ai #sast

7 min read

Toni Antunovic

Apr 11

When a Git Branch Name Becomes a Weapon: The Codex Command Injection That Could Steal Your GitHub Token

#security #github #devsecops #claudecode

6 min read

Toni Antunovic

Apr 11

OWASP Top 10 for Agentic Applications 2026: What Every Claude Code User Needs to Know

#owasp #security #claudecode #devsecops

3

2

11 min read

Toni Antunovic

Apr 7

When Your Security Scanner Becomes the Weapon: Lessons from the Trivy Supply Chain Attack

#security #devops #github #devsecops

1

2 min read

Toni Antunovic

Apr 4

npm Provenance and SLSA: The Supply Chain Hygiene Baseline Every Team Needs in 2026

#security #npm #devops #javascript

5 min read

Toni Antunovic

Apr 4

MCP Connector Poisoning: How Compromised npm Packages Hijack Your AI Agent

#security #npm #javascript #devops

2

5 min read

Toni Antunovic

Mar 31

SAST False Positives in AI-Generated Code: Why 91% of Alerts Are Noise (And How to Fix It)

#sast #security #ai #codequality

8 min read

Toni Antunovic

Mar 27

The Hidden Cost of Code Duplication in AI-Assisted Development

#webdev #ai

7 min read

Toni Antunovic

Mar 27

Prompt Injection in AI Coding Agents: How Malicious Dependencies Hijack Your Claude Code Sessions

#security #claudecode #ai

8 min read

Toni Antunovic

Mar 27

RSAC 2026: Every AI IDE Is Vulnerable - Here's What That Actually Means for Your Workflow

#security #ai

6 min read

Toni Antunovic

Mar 24

AI Code Review Tools Compared: What Actually Catches Bugs in AI-Generated Code?

#security #ai #devtools #programming

8 min read

Toni Antunovic

Mar 24

Local-First Code Quality for Claude Code: How to Catch Bugs Before They Leave Your Machine

#security #ai #devtools #productivity

8 min read

Toni Antunovic

Mar 23

The Claude Code CVE That Should Change How You Review AI-Generated Code

#security #ai #devtools #webdev

1

5 min read

Toni Antunovic

Mar 22

A post-mortem on the fastest database breach of 2026 - and the quality gate that would have stopped it cold.

#ai #codequality #database #security

5 min read

Toni Antunovic

Mar 16

The Vibe Coding Security Checklist: 10 Checks to Run Before You Ship AI-Generated Code

#vibecodingsecurity #ai #bestpractices #programming

1

10 min read

Toni Antunovic

Mar 13

AI Writes Code. But Who Checks It?

#ai #programming #opensource #devtools

1

3 min read

Toni Antunovic

Mar 12

Running code quality pipelines during AI coding workflows

#sonar #security #snyk #code

6

1 min read

DEV Community

Badges

1 Week Community Wellness Streak

Writing Debut

Transitive Prompt Injection in Multi-Agent Coding Pipelines: One Poisoned Tool, Every Downstream Agent

Want to connect with Toni Antunovic?

Slopsquatting: The Attacker Playbook for AI-Hallucinated Package Names

When Every PR Is a Rubber Stamp: What Automated Gates Catch That Exhausted Reviewers Miss

Clinejection: When Your AI Coding Tool Became the Weapon

CLAUDE.md Is a Security Boundary

What LucidShark Would Have Caught Before the TanStack Attack Landed

Approve Once, Exploit Forever: The Trust Persistence Vulnerability Vendors Will Not Fix

How to Review Code Your AI Agent Wrote While You Were Sleeping

The Georgia Tech CVE Data Shows AI Code Tools Have a Volume Problem

The Co-Authored-By Copilot Controversy Misses the Real Problem

CVE-2026-26268: How Cloning a Repo Can Now Execute Attacker Code in Your AI IDE

The MCP RCE That Anthropic Won't Patch: Your Enforcement Checklist

572K Weekly Downloads, One Preinstall Script: The SAP CAP Supply Chain Attack Your AI Agent Would Have Missed

When Your AI Coding Tool Disappears Overnight: The Case for Provider-Agnostic Quality Gates

AI Hallucinated Dependencies Are the New Supply Chain Attack: How to Stop Them

AI Agents Generate Code That Passes Your Tests. That Is the Problem.

Project Glasswing Found 35 CVEs in March. Here Is the Quality Gate You Need Before AI Agents Touch Your Codebase.

When a Git Branch Name Becomes a Weapon: The Codex Command Injection That Could Steal Your GitHub Token

OWASP Top 10 for Agentic Applications 2026: What Every Claude Code User Needs to Know

When Your Security Scanner Becomes the Weapon: Lessons from the Trivy Supply Chain Attack

npm Provenance and SLSA: The Supply Chain Hygiene Baseline Every Team Needs in 2026

MCP Connector Poisoning: How Compromised npm Packages Hijack Your AI Agent

SAST False Positives in AI-Generated Code: Why 91% of Alerts Are Noise (And How to Fix It)

The Hidden Cost of Code Duplication in AI-Assisted Development

Prompt Injection in AI Coding Agents: How Malicious Dependencies Hijack Your Claude Code Sessions

RSAC 2026: Every AI IDE Is Vulnerable - Here's What That Actually Means for Your Workflow

AI Code Review Tools Compared: What Actually Catches Bugs in AI-Generated Code?

Local-First Code Quality for Claude Code: How to Catch Bugs Before They Leave Your Machine

The Claude Code CVE That Should Change How You Review AI-Generated Code

A post-mortem on the fastest database breach of 2026 - and the quality gate that would have stopped it cold.

The Vibe Coding Security Checklist: 10 Checks to Run Before You Ship AI-Generated Code

AI Writes Code. But Who Checks It?

Running code quality pipelines during AI coding workflows