Learn about agentic coding security and Endor Labs

The first part of the EU Cyber Resiliency Act comes into effect on September 11th. Are you Ready?

Better models are making agent patch review more expensive, not less

GPT-6 Astra on Codex - the Biggest Codex Leap to Date

How Endor Labs AI SAST Learns What Matters to Your Organization

From SDLC to ADLC: why application security needs coding agent governance

Hooks are the control plane for the agentic development lifecycle

The real test of AI-native code analysis: is your security debt shrinking?

Mini Shai-Hulud worm hits openapi-react-query-codegen, spreads across npm, RubyGems, and PyPI

FedRAMP 2026 vulnerability rules make reachability a requirement

Customer Zero: Implementing Package Firewall at Endor Labs

Heaps of Built-in's: How JavaScript Sandboxes work

GHSA-864f-rcv7-6rh4: Critical Type Confusion Vulnerability in isolated-vm

Why C Has Always Broken Static Analysis

Why Endor Labs AI SAST for C finds what other tools miss

Hacking your life with AI can get you hacked

How AI orchestration platforms ship RCE by design

When you can't upgrade: open source examples of Endor Patches

AI SAST: Code Security for the Agentic SDLC

CISO's Guide: Build vs Buy AI Code Security

Why NPM Malware Keeps Reaching for Bun

Best in Class, Novel in Method: Opus 5 and the Recall-Then-Diverge Pattern

The Registry Just Became a Checkpoint. It Still Isn't Your Perimeter.

NPM Malware Compromises keyv and cacheable with 500M+ Weekly Downloads and Spreads to Hundreds of Packages

Critical Security Controls for Governing AI Coding Agents

Endor Labs for Connected Products

Endor Labs for Software & Tech

Endor Labs for Financial Services

SBOM Hub & VEX

Endor Patches

Artifact Signing

AI Model Governance

AI Code Review

Container Security & Reachability

Coding Agent Governance

Package Firewall

Secrets Detection

Software Supply Chain Security

AI Code Governance: Secure AI-Generated Code and Govern the Agents That Write It

Agentic Remediation: Remediation at Machine Speed, Grounded in Security Context

Endor Labs Recognized by Gartner® in the 2026 Hype Cycle™ for Application Security

The OpenAI and Hugging Face security incident: why AI agents need deterministic guardrails

Beyond MCP: The New Security Playbook for Coding Agents

OpenAI Codex with GPT-5.6 Sol: competitive, zero cheating, one unique Django fix

How Unprotected Release Branches Let Attackers Compromise AsyncAPI

Everyone Wins Their Own Benchmark

Sonnet 5 vs Fable 5: reliable versus security-forward, not better versus worse

Claude Sonnet 5 with Cursor: strong reasoning, throttled by the harness

Egnyte Accelerates FedRAMP & Protects Engineering Velocity with Endor Labs

Cyber insurers are pricing based on patching speed

Endor Labs Named in the 2026 Gartner® Hype Cycle™ for Secure Software Engineering

Claude Sonnet 5 with Claude Code: strong on function, average on security, and unusually honest

Endor Labs’ AI SAST Finds Zero Day Memory-Amplification DoS in Anthropic’s buffa library

Benchmarking Endor Labs AI SAST: 2.6x more real vulnerabilities found than frontier models

Shai-Hulud Strikes Leo Platform npm

Open source carries the world. Patching it at Mythos-scale can't fall to maintainers alone.

Endor Labs is a Visionary in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security

Claude Fable 5, take two: same model, different harness, and a very different result

AppSec was built to find problems. The Mythos era demands you fix them, fast.

Mastra npm Org Compromised: Multiple Packages Trojanized to Drop a Remote Payload via easy-day-js

The Token Economics of AI AppSec Agents

Build vs. Buy Code Security: Same Model, Same Tasks, 12x the Token Bill

Claude Fable 5: Mythos-grade hype, record cheating, and a few hall-of-fame entries

Recall, not reasoning: how AI coding agents cheat security benchmarks

Endor Labs Named a Representative Vendor in the 2026 Gartner® Innovation Insight for Agentic Application Security Testing

Shai-Hulud "Hades" Wave Hits Six PyPI Bioinformatics Packages via Stolen Tokens

Trojanized ai-sdk-ollama Delivers Miasma, a Self-Replicating npm Worm via binding.gyp

Endor Labs Recognized in the Forrester Agentic Development Security Tools Landscape

Endor Labs + Cursor: Building the security foundation for agentic coding

Designing Reports for Three Different Workflows

Endor Labs Recognized by Gartner® in the 2026 Hype Cycle™ for Platform Engineering

Trojanized Microsoft SDK: durabletask 1.4.1 through 1.4.3 Deliver Credential-Stealing Malware

Endor Labs and Chainguard Partner to Deliver End-to-End Software Supply Chain Security

Mini Shai-Hulud Returns: 600+Malicious npm Packages Fake Sigstore Badges in AntV Ecosystem Attack

Designing AI Coding Agent Governance: A New Surface for AI Risk

When the Guardrails Slip: The Case for Hook-Based Governance Across Agent Platforms

From Code to Cloud: Endor Labs Joins the Wiz Integration Network

How a Misconfigured CI Workflow Became an npm Supply-Chain Compromise

Introducing AI Coding Agent Governance: Using Hooks to Bring Visibility to the ADLC

Introducing Package Firewall

Malware Defense: A Multi-Agent Detection Engine and Package Firewall

Introducing Security for AI Coding Agents and Workstations

Shai-Hulud compromises the @tanstack ecosystem: 160+ packages compromised

Popular lightning PyPI Package Backdoored in Latest Shai-Hulud Wave

Beyond Mythos: A CISO's Guide to Building an Effective Software Security Program for the AI Era

Mini Shai-Hulud: npm Worm Hits SAP Developer Packages

GPT-5.5 Sets a New Code Security Record with Cursor, not Codex, in Agent Security League

Inside the Bitwarden Software Supply Chain Attack (Shai-Hulud)

The agent control plane needs a security layer

Organizational Behavior Predicts OSS Malware Program Success

Claude Opus 4.7 Sets New Records in the Endor Labs Agent Security League

Surge in submissions forces NIST to change how it handles CVEs. Here's what it means for vulnerability management.

The Dangers of Reusing Protobuf Definitions: Critical Code Execution in protobuf.js (GHSA-xq3m-2v4x-88gg)

It's About Thyme: How a Whitespace Character Broke Thymeleaf's Expression Sandbox (CVE-2026-40478)

Agent Security League: Evaluating the Security of AI-Coded Software

Is AI Coding Safe? Introducing the Agent Security League

The Unkillable C2: How Attackers Are Moving Command and Control to the Blockchain

Fable 5.1 takes the top spot — faster than Opus 5, cheaper, and cleaner

Root in One Request: Marimo's Critical Pre-Auth RCE (CVE-2026-39987)

What Security and Engineering Teams Fear Most About Malware