Blog

Novee Security reveals critical flaws in Anthropic, Google, and OpenAI coding agents, showing how zero-privilege inputs trigger remote code execution, data exfiltration, and supply chain compromise.

Novee Security researchers uncovered 12 vulnerabilities across major Enterprise Java platforms, demonstrating how unauthenticated attackers can exploit middleware components to achieve remote code execution.

Novee's research team discovered Cordyceps, a critical supply chain flaw hiding in plain sight, impacting code repositories at thousands of organizations, including Microsoft, Google, Apache, and Cloudflare.

Novee researcher discovered a high-severity arbitrary code execution vulnerability in Cursor IDE (CVE-2026-26268). Learn how AI agents and Git hooks create a dangerous new attack surface for developers.

Our researchers found 3 critical vulnerabilities in PDF ecosystems. Then we let our trained AI loose, and found 13 more.

Inside Novee’s approach to scaling zero-day discovery by compounding exploit reasoning across modern PDF platforms.

Novee's agent saw something worth investigating. Our researchers proved it was worth a CVE.

In live-browser exploit benchmarks, Novee’s 4B-parameter model achieved up to 90% accuracy, outperforming Claude 4 Sonnet and other frontier LLMs by over ~55%.

Modern web apps layer defenses so thick that XSS should be impossible. Attackers still find ways through. We wondered: could we teach AI to probe, adapt, and reason its way…