Research Blog
Lessons from a year of agent CVEs
We read every published security issue in AI coding agents from the past year. Most sit in the code around the model, and a quarter need no model at all.
Read more
Research 
Research The librarian who refused to code
We gave AI models fictional identities. Then the AI reviewing our research got a little too involved.
Research The tool blocked it, but the agent kept going.
An MCP tool denied a production change, so the control looked like it worked. The agent switched to Bash and made the same change anyway. A block on one tool does not prove the action is blocked.
Research You cloned a repository. Your agent trusted it. Now what?
A repository can ship its own agent configuration. Trust a parent folder once, and a cloned repo can redirect your coding agent's traffic to an attacker-controlled endpoint on the first question you ask.
Product & Open Source Agentic control for software engineers
An enterprise-grade control layer on top of coding agents, keeping engineers in control without giving up the speed of auto-approval.
Product & Open Source SaaS is dead. But not because AI "killed" it, because AI killed it.
SaaS is dead, and vibe coding killed it from within. Why today's coding agents are built for vibe coders, not the software engineers who actually pay for them.
Research Who is profiling whom: what attackers fear about AI correlation
A Russian-language cybercrime thread shows attackers fragmenting malicious work across models and accounts to slip past per-request AI controls — and fearing the one thing that defeats it: correlation across behavior, identity, and context.
Product & Open Source Angry Bear: enforcing the skills your coding agent keeps forgetting
Angry Bear is Bluebear's open-source pre-tool-use hook that blocks AI coding agents from editing files until the required skills are loaded, turning 'please follow the conventions' into a precondition. MIT, works with Claude Code and Cursor.
Product & Open Source Bear Metal: the coding agent we point at our own backlog
Bear Metal is Bluebear's open-source background coding agent: it works tickets delegated through Linear and opens pull requests through your GitHub App installation.
Research The mandate gap: the agent risk your security stack can't see
Coding agents introduce a new class of risk: the gap between what a user authorized and what the agent actually did. Why your existing controls miss it, and how to govern intent instead of just actions.
Research The missing dependencies hidden inside AI agent skills and plugins
We found 72 exported AI agent skills and plugins referencing packages with no registry record on npm, PyPI, or Cargo. These missing references create opportunities for slopsquatting attacks.
Product & Open Source Baloo: the code reviewer we built for our own agents
Baloo is Bluebear's open-source GitHub App for self-hosted AI pull request review, built from the agent we used to review our own agent-generated code.
Research The hidden Git branch that leaked 20,000+ AI coding sessions
While tracing the source of an AI coding-agent dataset, we found 20,000+ agent sessions exposed through public Git branches, including API keys, credentials, infrastructure details, and screenshots.
Research It's not what the model writes. It's what the agent runs.
Recent threat intelligence details how cybercriminals are using headless coding agent frameworks on compromised hosts to automate source code exfiltration.
Research The hidden attack surface inside every coding agent
Most teams still talk about coding agents as if they're just LLMs that write code. That misses the real security picture.
Research The credentials your AI agent sees (and why you should care)
AI agents increasingly need credentials to act on our behalf, and by doing that are quietly turning local configuration files and shell profiles into a secondary, high‑risk credential store. That creates a new security boundary, a phenomena we call context‑window credential drift
Research The coding agent ecosystem is now a target
Attackers aren't just targeting what coding agents do — they're going after the entire ecosystem around them. InstallFix is only the latest example.
Ready to start securing your AI agents?
©2026 Bluebear Security Inc. All rights reserved. · info@bluebear.io · (929) 702-2605 · About · Contact · Developers · Integrations · Privacy 
