OWASP Releases Agentic AI Top 10 Risks; Developer Shares Practical Fixes

·9 views

OWASP published its Top 10 risks for agentic AI applications in December 2025, covering threats numbered ASI01 through ASI10. A developer running six AI agents and 14 MCP servers on a personal laptop translated each risk into concrete, real-world mitigations. Key changes included pinning MCP server versions after discovering 12 of 14 were running unpinned packages, assigning individual keypairs per agent, and restricting tool-call permissions based on arguments rather than tool names. The developer also flagged memory poisoning as a serious concern, noting that content written to agent memory files affects all future sessions and must be treated as untrusted input. The core takeaway was to enforce security gates at the action level rather than relying on prompt filtering, and to maintain verifiable audit records of every agent action and policy in force.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

You.com Research API Gains Background Mode for Long-Running Async Tasks

You.com has updated its Research API to support background task execution, allowing clients to submit a research request with a background flag and receive a task ID instead of waiting for results in real time. This asynchronous approach is designed for deep, exhaustive, and frontier research jobs that may exceed standard request timeout limits. Developers can check job status by polling a dedicated endpoint or receive live progress updates via a Server-Sent Events streaming endpoint. The change makes it practical to embed research tasks into automation pipelines, internal tools, and data-enrichment workflows without risking connection timeouts. Frontier, You.com's most intensive research tier, requires background mode and is documented in the platform's official API changelog and Quickstart guide.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How One Operator Change Transforms Subset Sum Into a Counting Problem

A tutorial on dynamic programming explains how the 'Count of Subsets' problem differs from the classic Subset Sum by just one change: replacing the boolean 'or' operator with integer addition '+'. While Subset Sum asks whether a target sum is achievable, Count of Subsets asks in how many ways it can be achieved, shifting the DP table from storing booleans to storing counts. The base case requires careful handling — only T[0][0] should be set to 1, representing the empty subset, rather than setting the entire first column to 1, which breaks correctness when the array contains zeros. Zero-valued elements are a special trap because including or excluding them both leave the sum unchanged, meaning each zero doubles the valid subset count. The inner loop must also start from index 0 instead of 1 so that zero-valued elements are processed correctly through the transition logic.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

HYNAWEB and Akhouri Systems partner to build privacy-first tools for developers

M. Harun, founder of the HYNAWEB holding company, has announced a formal partnership with Akhouri Systems, a privacy-first desktop software firm led by co-founder Akhouri Anmol Kumar. HYNAWEB develops browser-based, AI-powered developer tools including KODA, Dojo Feed, and Scribe Jam, while Akhouri Systems builds lightweight, offline-capable Windows utilities such as ATLOCK, ANOTE, ACALCU, and APIC. The two startups say they joined forces because their products complement each other across web and desktop platforms, aiming to offer developers a unified ecosystem without data collection or bloat. A phased roadmap has been outlined, beginning with cross-promotion and moving toward technical integration, such as embedding APIC's image processing engine inside KODA. Both teams say they are building in public and plan to consolidate their developer communities under a shared Discord space.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DOT Construction Dates Shift Constantly — A Change Log Shows How Much

Transportation agencies routinely revise projected start and end dates for road construction projects after they are published, leaving planners who rely on static snapshots with outdated information. A dataset tracking 2,269 active planned-construction projects across several US states and one Canadian province recorded 21,289 date revisions between July 3 and September 17, 2026. Of those revisions, 21,128 moved a date later and only 161 moved it earlier, indicating that published start dates function effectively as minimum estimates rather than reliable targets. The median revision shifted a projected start by seven days, while the largest single change pushed a ramp closure on I-81S back by 61 days in one edit. To address this, the platform maintains a queryable change log that records old values, new values, and timestamps each time a project date is updated, turning a static date field into a trackable history.

0 comments Read more at DEV Community