Harness engineering: how to make AI coding agents reliable and secure | Blog | Endor Labs
Learn how harness engineering makes AI coding agents reliable and secure with guides, sensors, and built-in security checks
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,720 matching stories — announcement, in Application Security (ASPM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR
Wiz Red Agent independently discovered and exploited a GitHub Actions injection missed by GitHub’s Advanced Security, validated access to sensitive data in Snowflake’s internal Jira, and assessed the blast radius—all without human intervention, five days after the flaw became live.
The Next Model Won’t Fix This: Three AppSec Imperatives From Black Hat USA 2026
Black Hat USA 2026 didn’t introduce the AI security problem, but made it clear how fast that problem is becoming operational. An independent study initiated and funded by Checkmarx helps explain why. On real-world repository tasks, frontier models produced working code 83% to 95% of the time, but only 24% to 36% of their solutions […]
Claude Opus 5: An evaluation review & metrics benchmarks
Learn what Claude Opus 5 performance metrics reveal about code quality security findings review effort and the impact of generating far more code.
Your secrets are leaking to AI coding agents (and how to stop it)
Learn how AI coding agents can expose secrets and how local detection helps keep credentials from reaching model providers and external logs.
Claude Code hooks and how Sonar Vortex verifies AI code inside the loop
Learn how Claude Code hooks enforce deterministic AI guardrails and how Sonar Vortex verifies AI generated code inside the development loop.
Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline
Operation ASTERIX overviewRapid7 researchers identified an exposed web directory on infrastructure used to support a cryptocurrency fraud operation. The server contained raw phone-number datasets, account-validation tools, enriched lead records, phishing panels, voice-dialing scripts, fake wallet applications, persistence mechanisms, and Telegram exfiltration code. Among the artifacts was evidence that the operator relied on AI coding assistants throughout the campaign's development; recovered p
Critical SAP Commerce Cloud flaw exploited days after patch
SAST False Positives: Why Static Analysis Alone Fails and How Execution Context Fixes It
A developer opens the latest SAST report and finds 430 new findings. The security team spends days reviewing them, developers question the alerts, and release work slows while everyone separates exploitable weaknesses from safe code. Meanwhile, a genuinely exploitable vulnerability may receive less attention because it is buried among findings that static analysis cannot validate ... Read more The post SAST False Positives: Why Static Analysis Alone Fails and How Execution Context Fixes It appea
Africa’s Cybersecurity Challenge Is Bigger Than Access to Technology
Gopan Sivasankaran is Rapid7's Regional Director, Middle East & Africa.Across Egypt, Nigeria, and Kenya, organizations are expanding their use of cloud infrastructure, artificial intelligence, digital services, and connected operations. But more technology does not automatically create stronger security operations; many security teams are not short on data, but rather on time, context, and specialist capacity.As environments expand, the challenge is no longer finding another security product. It
AI Agents Lie, Cheat, and Steal – So We Built the Barbed Wire
AI agents can access credentials, tools, and systems autonomously. Learn why layered Zero Trust runtime controls are needed to secure AI agents.
What the CISO role will look like in 2029
Posture-Safe Dependency Remediation: Upgrade PRs That Don't Make Your Security Worse
Dependabot bumps the version. ZeroPath makes sure the upgrade doesn't add a new CVE, proves transitive fixes in a sandbox, and flags which of your call sites might break.
CRA Product Classification Explained: Default, Important, and Critical
How the EU Cyber Resilience Act classifies products with digital elements (Default, Important Class I and II, and Critical), with the full Annex III and Annex IV product lists and what each tier means for self-assessment, third-party conformity assessment, and CE marking.
Detection Is Not Coordination: What Small Utilities Still Need After Water Watch
The Water Watch Center gives small water utilities no-cost cyber detection. The next challenge is funding resilient response coordination.
Learning to Cheat: Why an OpenAI Model Hacked Into Hugging Face
An OpenAI model under evaluation broke out of its sandbox and into Hugging Face's infrastructure to steal the answers to the benchmark it was being graded on. Reward hacking explains it better than any of the individual vulnerabilities do.
Supply Chain Security Analysis of a 9.5M-Install VS Code Extension
Your code editor extensions auto-update and run with your privileges on the machine that holds your source code, your SSH keys, and your publishing credentials, but they rarely show up in a software bill of materials. Using Neo we audited one of the most popular ones, Markdown Preview Enhanced has roughly 9.5 million installs. The neo found five CVEs across two attack surfaces. A WaveDrom rendering bug turned an ordinary Markdown file into JavaScript execution inside the preview, then into arb
AI Code Security: A Three-Tier Model for Secure AI-Generated Code
A working framework for AI code security, reasoning about where AI coding agents get security right by default, where they need a nudge and where gaps remain.
What Is Mythos and Why It Matters for Software Security | Blog | Endor Labs
Learn what Mythos is, how it found zero-day bugs, and why Mythos could reshape software security and vulnerability prioritization
What is an agent harness? The software that turns a model into an agent | Blog | Endor Labs
Learn what an agent harness is, how it turns an LLM into an agent, and why its tools, memory, and guardrails shape speed, reliability, and risk
Metasploit Wrap Up: Lot of summer shells and fit http profiles
This wrap-up brings a full-on shell parade. Thirteen shiny new modules landed, starting with a buffet of RCEs. WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard, a Pix-for-WooCommerce, and for those who like their exploits closer to the bare-metal, the Fragnesia Linux kernel LPE (CVE-2026-46300). Metasploit also got the glow-up of the summer with the new http malleable profiles, MCP functionality and linux multi fetch payloads (mor
Top enterprise SCA tools in 2026
Compare enterprise SCA tools for 2026: Aikido, Sonatype, Snyk, Endor Labs, Checkmarx, Black Duck, and Veracode on intelligence, remediation, and compliance. Category: DevSec Tools & Comparisons
The AI coding security gap: Why faster development demands stronger guardrails
AI can dramatically accelerate software delivery, but speed without security creates new forms of risk Anyone who’s watched an AI coding assistant generate a working API endpoint, scaffold a microservice, produce a comprehensive test suite, or create a user interface understands deep in their core that software engineering has fundamentally changed. The velocity of AI […] The post The AI coding security gap: Why faster development demands stronger guardrails appeared first on Black Duck.
Top enterprise DAST tools in 2026
Compare the top enterprise DAST tools of 2026 on authenticated coverage, API discovery, exploit validation, governance, compliance, and AI pentesting Category: DevSec Tools & Comparisons
Escape vs StackHawk: full DAST comparison 2026
Last updated: August 2026. StackHawk's positioning changed materially in December 2025 with the launch of Business Logic Testing for APIs (Cross-profile BOLA/BFLA only), and again through 2026 with coding-agent integrations. This comparison reflects those changes.
Agentic AppSec Governance: The Enterprise Security Harness
Application security teams are no longer struggling to find issues. For many teams, the bigger problem is getting fixes shipped fast enough. For two decades, the industry focused heavily on detection. We built static analyzers, dynamic scanners, and software composition analysis tools. The result was a massive volume of alerts, endless Jira tickets, and developers who felt bogged down by security workflows. In many enterprise environments, remediation has become the slower and more expensive par
Top unified security tools in 2026
Compare the top unified security tools of 2026: Aikido, Cortex Cloud, Wiz, Checkmarx, Snyk, and Orca, across coverage, correlation, governance, and cost. Category: DevSec Tools & Comparisons
Scale Your Engineering Organization Without Losing Control
Growing engineering organizations all hit the same wall. More teams shipping software means more repositories, more permission requests, more onboarding cycles, and eventually one platform admin fielding every change. The platform that was supposed to accelerate delivery has now become the bottleneck. JFrog Projects is built to break that pattern. It’s the organizational structure that …
FCC, CRA, and IEC 62443: Three Gates to Robotics Market Readiness
Robot manufacturers face distinct FCC Covered List, the EU Cyber Resilience Act (CRA), and IEC 62443 requirements. Learn how shared security workflows can support readiness across all three.
GrammaTech Brings Software Resilience and Cyber Defense Innovation to DARPA ERIS Marketplace
Ithaca, NY — GrammaTech, a leading provider of software assurance and cyber resilience research and industry-leading products, announced that it has achieved “awardable” status through DARPA Expedited Research Innovation System (ERIS) Marketplace. The post GrammaTech Brings Software Resilience and Cyber Defense Innovation to DARPA ERIS Marketplace appeared first on GrammaTech.
CMMC on Pause: What Companies in the DoD Supply Chain Should Know and Do Next (Part 1 of 4)
Create histogram metrics at ingest with OpenPipeline
Histogram metrics preserve the full distribution of your observability data, enabling accurate percentile analysis and service-level objective (SLO) measurement. Dynatrace now extracts histogram metrics from spans and logs during ingestion with OpenPipeline, so you can capture latency distributions and other high-value metrics without re-instrumenting your services. This post explains how histogram metrics work, why they […] The post Create histogram metrics at ingest with OpenPipeline app
End-to-end observability at scale starts with knowing what you’re running
Dynatrace Fleet Management gives administrators a single app to monitor, manage, and install OneAgent and ActiveGate components across large environments. The post End-to-end observability at scale starts with knowing what you’re running appeared first on Dynatrace news.
Looking Beyond Lakera? 6 Alternatives That Made Our Shortlist in 2026
Lakera Overview (Now Part of Check Point) Lakera helped establish the market for dedicated security controls around generative AI applications. Its evolution under Check Point now gives security teams a broader platform context, but it also changes how buyers should assess architectural fit. As an independent platform, Lakera focused on protecting generative AI applications through ... Read more The post Looking Beyond Lakera? 6 Alternatives That Made Our Shortlist in 2026 appeared first on Rein
Moderne is a Gartner® Magic Quadrant™ Leader. The difference is determinism.
Rule-based tools can beat a purely LLM approach at refactoring, per Gartner. How the LST and OpenRewrite recipes make modernization verifiable, not probable
Why It’s Vital to Stay Secure Whilst AI Accelerates Innovation
Why CI Security Guidance Keeps Failing Small Utility Operators
Most critical infrastructure security guidance is built for large enterprises, not small utilities. Here is a practical framework for operators with limited staff and budget.
Data pipeline monitoring 101: Tracking health and performance across the data stack
Learn about monitoring the end-to-end health and performance of modern data pipelines.
Comment on What is a CBOM (Cryptography Bill of Materials)? by How To Build A Cryptographic Inventory For CNSA 2.0 | SCANOSS
[…] structured, not narrative. A Cryptography Bill of Materials in the CycloneDX format, as outlined in What is a CBOM?, gives each finding a consistent schema covering algorithm family, specification, and location, […]
How to build a cryptographic inventory for CNSA 2.0
TL;DR CNSA 2.0 is the NSA’s mandated suite of quantum-resistant algorithms for National Security Systems, and it carries category-specific deadlines running from 2025 through 2033. Every one of those deadlines assumes an organisation already knows which algorithms it uses and where. Most do not, because cryptography is typically inferred from configuration files and dependency manifests rather than from the code that actually implements it. Building a genuine cryptographic inventory means