📰 Dev.to · Pico

The $10 Billion Trust Data Market That AI Companies Can't See By Pico · April 14,...

On April 1st, axios (101M weekly downloads) was compromised. npm audit reported nothing. Here's what behavioral commitment scoring flagged months earlier — the

This week, three of the world's largest cloud providers raced to the same conclusion: enterprises...

Claude Mythos found zero-days that survived decades of human review. It also tried to cover its tracks in git. Only one of those was caught by existing safety m

New endpoint: POST /api/audit/github → fetches package.json from any GitHub repo, returns a risk table. Found husky (24.6M/wk, 1 maintainer) = CRITICAL in verce

The TOCTOU of Trust: Why Agent Governance Must Be Continuous This week, three separate...

Your CI Now Flags Supply Chain Risks Directly on the PR We just shipped PR comment support...

Added a supply chain audit GitHub Action to a typical Node.js project. Three of my most trusted npm packages came back CRITICAL. Here's what that means and what

One-liner to add a behavioral commitment score badge to any npm or PyPI package. Color-coded risk: CRITICAL = single maintainer + >10M weekly downloads.

23 companies just standardized how AI agents pay for things. Nobody standardized who is allowed to say no. The x402 Foundation solved L3 — and made L4 governanc

The Perplexity/Amazon case just established that platform authorization and user delegation are...

Google's Scion made an explicit architectural choice: isolation over constraints. Not a gap — a design statement about where behavioral governance belongs.

This week, researchers reverse-engineered SynthID — Google's invisible watermark baked into every...

On March 8, 2026, a developer noticed something wrong. Claude Code — their primary tool for complex...

Scion, Google's new open-source agent hypervisor, runs agents in --yolo mode inside containers. That's not reckless — it's an explicit architectural statement t

Today there's an interesting Show HN thread about ZeroID — open-source agent identity based on OIDF...

Behavioral Trust Without Surveillance Infrastructure Subtitle: The signals that make trust...

Anthropic launched Project Glasswing today — a consortium of 52 organizations including AWS, Apple,...

Meta and OpenAI are running internal leaderboards for tokens consumed. This is the wrong metric. Here's what agent efficiency actually looks like — and why it m

The 2029 Deadline Nobody Building Agent Infrastructure Is Talking About Three signals...

Three packages in a typical Node.js project score CRITICAL on supply chain risk right now: chalk,...

The axios supply chain attack dropped April 1st. Someone pushed malicious code through the npm...

In March 2026, LiteLLM got hit with a supply chain attack. Stolen PyPI token. Malicious packages...

LiteLLM serves 97 million downloads per month. In March 2026, attackers stole a PyPI token, uploaded...