AI Coding Assistants Can be Both a Friend & a Foe
New research shows that GitLab's AI assistant, Duo, can be tricked into writing malicious code and even leaking private source data through hidden instructions embedded in developer content like merge requests and bug reports.
How? Through a classic prompt injection exploit that inserts secret commands into code that Duo reads. This results in Duo unknowingly outputting clickable malicious links or exposing confidential information.
While GitLab has taken steps to mitigate this, the takeaway is clear: AI assistants are now part of your attack surface. If you’re using tools like Duo, assume all inputs are untrusted, and rigorously review every output.
Read the details: https://arstechnica.com/security/2025/05/researchers-cause-gitlab-ai-developer-assistant-to-turn-safe-code-malicious/
The EU 
to launch its own vulnerability database because the US is dropping the ball 
— and the timing couldn’t be more telling 
Track and disclose security bugs across government, industry, and open source
Complement—not compete with—the CVE Program
Increase trust, transparency, and resilience within the bloc
Multiple public vuln databases means we must align identifiers, disclosure standards, and data feeds—or risk fragmentation
Transparency is great, but what about verification, consistency, and maintenance?
And if vendors or agencies self-report, how do we ensure accuracy or prevent omission?
It’s Webinar Time! Secure coding isn’t just about writing safer software—it’s a career game-changer.
, RAD Security
Register here: 
Live code reviews & secure fixes
Automation tips for secure defaults
What effective training really looks like
OpenSSF is securing the open source ecosystem! With over 100 members and thousands of contributors, we’re shaping the future of secure software development.
Download the Annual Report to see our impact in 2024: 
