Search Results

Customer Zero: Implementing Package Firewall at Endor Labs

How JavaScript Sandboxes Work

GHSA-864f-rcv7-6rh4: Critical Type Confusion Vulnerability in isolated-vm

Why C Has Always Broken Static Analysis

Why Endor Labs AI SAST for C finds what other tools miss

Hacking your life with AI can get you hacked

How AI orchestration platforms ship RCE by design

When you can't upgrade: open source examples of Endor Patches

How Endor Labs AI SAST combines program analysis, agentic reasoning, and deterministic engineering to find and fix the flaws that matter in AI-written code.

CISO's Guide: Build vs Buy AI Code Security

Why NPM Malware Keeps Reaching for Bun | Supply Chain Security

Best in Class, Novel in Method: Opus 5 and the Recall-Then-Diverge Pattern

Endor Labs for Connected Products

Endor Labs for Software & Tech

Endor Labs for Financial Services

SBOM Hub & VEX

Endor Patches

Artifact Signing

AI Model Governance

AI Code Review

Container Security & Reachability

AI Coding Agent Governance: The Security Layer for the Agentic SDLC

Package Firewall

Secrets Detection: Find the Secrets That Are Actually Live

Software Supply Chain Security

AI Code Governance: Secure AI-Generated Code and Govern the Agents That Write It

Agentic Remediation: Remediation at Machine Speed, Grounded in Security Context

Endor Labs Recognized by Gartner® in the 2026 Hype Cycle™ for Application Security

The OpenAI and Hugging Face security incident: why AI agents need deterministic guardrails

Beyond MCP: The New Security Playbook for Coding Agents

OpenAI Codex with GPT-5.6 Sol: competitive, zero cheating, one unique Django fix

Everyone Wins Their Own Benchmark

Sonnet 5 vs Fable 5: reliable versus security-forward, not better versus worse

Claude Sonnet 5 with Cursor: strong reasoning, throttled by the harness

Egnyte Accelerates FedRAMP & Protects Engineering Velocity with Endor Labs

Cyber insurers are pricing based on patching speed

Endor Labs Named in the 2026 Gartner® Hype Cycle™ for Secure Software Engineering

Claude Sonnet 5 with Claude Code: strong on function, average on security, and unusually honest

Endor Labs’ AI SAST Finds CVE-2026-55407: Memory-Amplification DoS in buffa

AI SAST found 192 real vulnerabilities, 2.6x more than Claude Code

Endor Labs is a Visionary in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security

Claude Fable 5, take two: same model, different harness, and a very different result

AppSec was built to find problems. The Mythos era demands you fix them, fast.

A single hijacked maintainer account pushed multiple trojanized packages across the entire @mastra scope in 27 minutes, each carrying a typosquat dependency that runs a remote payload on install. Combined reach is over 28 million downloads a month.

A controlled benchmark of AI agents with and without access to deterministic tools for performing common security tasks

The token economics of using AI coding agents for security tasks

Average results with 59.8% on functional solves and just 19.0% on security solves

Recall, not reasoning: how AI coding agents cheat security benchmarks

Endor Labs Named a Representative Vendor in the 2026 Gartner® Innovation Insight for Agentic Application Security Testing

Shai-Hulud "Hades" Wave Hits Six PyPI Bioinformatics Packages

Malicious Payload in ai-sdk-ollama npm Package

Endor Labs Recognized in the Forrester Agentic Development Security Tools Landscape

Endor Labs + Cursor: Building the security foundation for agentic coding

Designing Reports for Three Different Workflows

Endor Labs named a Representative Vendor for Software Supply Chain Security.

Malicious PyPI package durabletask 1.4.1-1.4.3 steals AWS, Azure, and GCP credentials on import. 417k monthly downloads affected.

Endor Labs and Chainguard Partner to Deliver End-to-End Software Supply Chain Security

Mini Shai-Hulud Returns: 42 Malicious npm Packages Fake Sigstore Badges in AntV Ecosystem Attack

Designing AI Coding Agent Governance: A New Surface for AI Risk

When the Guardrails Slip: The Case for Hook-Based Governance Across Agent Platforms

Endor Labs joins the Wiz Integration Network (WIN), bringing reachability-backed SCA and AI SAST to Wiz for unified code-to-cloud risk context.

A technical explainer of the attack chain behind the May 11, 2026 TanStack compromise

Learn how hooks turn AI coding agents like Claude Code and Cursor into governed systems with deterministic policy, centralized audit, and defense in depth.

Introducing Package Firewall

AURI secures the code AI agents write. Now, in collaboration with Cursor and Google, it secures the agents themselves.

Shai-Hulud compromises the @tanstack ecosystem: 80+ packages compromised

Anthropic's Claude Mythos disclosure has every security leader asking the same question: what now?

Mini Shai-Hulud: npm Worm Hits SAP Developer Packages

OpenAI's newest model now holds the top security score on the Agent Security League through Cursor as the agent harness. Through Codex, it ties for third on security but trails on functional correctness.

How attackers compromised Bitwarden's CLI and enlisted the help of AI coding agents to spread a worm and harvest developer secrets.

Security has to be embedded across the agent harness, orchestrator, and control plane if your organization wants to run software agents at scale.

Your org structure and dependency hygiene predict malware outcomes more than your tooling does. Here's what the data shows.

Anthropic's newest model reaches the highest functional and security scores we've ever measured. But roughly four out of five solutions still ship with vulnerabilities.

The Dangers of Reusing Protobuf Definitions: Critical Code Execution in protobuf.js (GHSA-xq3m-2v4x-88gg)

It's About Thyme: How a Whitespace Character Broke Thymeleaf's Expression Sandbox (CVE-2026-40478)

AI-generated code passes tests but fails security. This report benchmarks agents, exposing a persistent gap between functional correctness and secure outcomes.

AI coding agents can write working code, but mostly not secure code. Explore benchmark results showing over 80% of AI-generated code contains vulnerabilities.

Blockchain-based C2 lets attackers run malware infrastructure that can’t be taken down. Learn how it works, why it’s spreading, and what defenders can still do.

WebSocket pre-auth RCE, confirmed exploited in the wild within 10 hours of disclosure. Tens to hundreds of instances may remain exposed. Upgrade to 0.23.0.

What do security practitioners and software engineers actually fear about open source malware? We asked 605 professionals. Here is what 141 of them said, in their own words.

New Endor Labs research reveals 92% of npm account takeovers occurred in 2025, targeting packages with millions of downloads

Investigating, remediating, and hardening your environment in the wake of the TeamPCP campaign — from an organization that went through the process itself.

TeamPCP Strikes Again: Telnyx Compromised

Lessons in Hardening GitHub Actions

AI has collapsed the cost of offense to pocket change.

Supply Chain Attack on popular PyPI library LiteLLM

AI agents have transformed how software gets built, but they’re introducing risk at a scale humans can’t review. This solution brief shows how AURI by Endor Labs embeds security directly into developer workflows, combining agentic reasoning with deterministic program analysis to enable teams to code without compromise.