1. Snyk launches Evo Agentic AppSec, with a Dependency Firewall aimed at Curation

Snyk · October 15, 2026

Snyk’s biggest launch of the year packages its scanners as tools for a team of AI agents. Evo Agentic AppSec has five: a Code Scanning Agent that pairs AI reasoning with static analysis to find access-control and authentication logic flaws; an Evo Dependency Firewall that blocks malicious and out-of-policy packages at install time, slopsquatting included; an Agentic Security Review that builds an application and threat model for a whole repository; a Remediation Agent that fixes new code and backlog, starting with Snyk Open Source issues, and queues anything that might break the build for approval; and Secrets Detection from IDE to CI. Read the availability line closely. The Code Scanning Agent, Dependency Firewall and Security Review are an experimental preview for select customers; the Remediation Agent is in open preview; only Secrets Detection, Agentic Development Security and Continuous Offensive Security are GA. There is no pricing.

Snyk backs the launch with its own numbers: more than 4,800 customers, LLM-only security reviews that lost a finding on a rerun 49.7% of the time, and a Remediation Agent that produced mergeable fixes 90% of the time against 59.6% for an LLM alone. It also says new critical and high issues across its customers grew tenfold in a year, and that 36% of nearly 4,000 agent skills it audited had at least one flaw. CTO Manoj Nair’s line: “Agents do the work. Something independent proves it holds. Humans own the bar.”

So what for JFrog. Two weeks, two competitors launching something called a “Dependency Firewall”: GitLab last week, Snyk this week. Snyk’s is an experimental preview for selected customers, so in deals it is a roadmap slide. But the architecture Snyk describes, with agents on top of deterministic engines, is the same story we tell for JFrog Advanced Security. Our difference is where the block happens: at the repository every build already pulls through, not at an install hook a developer can go around. Reps should say that in one sentence and ask the customer what Snyk’s firewall does on a CI runner that never runs the Snyk CLI.

Sources: Snyk (Evo Agentic AppSec)

2. Sonatype puts Repository Firewall inside Nexus Repository

Sonatype · October 14, 2026

Nexus Repository Pro+ moves Sonatype’s Repository Firewall malicious-code protection and policy enforcement into the repository itself. When a developer or an AI agent requests a component, Pro+ screens open-source packages, AI models and MCP servers, then blocks or quarantines anything malicious, vulnerable or out of policy before it reaches the build. Policies cover security, legal, architecture and component age, drawing on a catalogue of more than 333 million components and more than 1.9 million malicious versions Sonatype says it has identified. Pro+ also proposes upgrade paths that it checks against existing build and test processes. It is available now; Nexus Repository Enterprise with the same protection follows “in the coming weeks.” No pricing was given, and JFrog is not named.

Sonatype’s own data makes the AI-model case: organisations adopting Hugging Face grew nearly 4.7 times year on year, and close to 7% of Hugging Face requests in its population were blocked by policy, against about 3.5% for Go and 1% for Cargo. Most blocked models (55%) failed on acceptability rather than security (18%). CTO Brian Fox: “AI changed the equation.” A companion blog post argues that “AI noise”, the flood of agent-generated dependency changes, has moved the bottleneck from writing code to validating it.

So what for JFrog. This is the most direct like-for-like move against Artifactory plus Curation this year: the firewall is now part of the repository SKU rather than a separate product, and it covers models and MCP servers. Expect Sonatype to price Pro+ against our Pro and Enterprise X bundles. Our counter is package-type breadth, the AI Catalog for models, and scale. But the message “firewall included in the repository” is now table stakes, and our packaging should state plainly that Curation does this, rather than leave the customer to assemble it from a price list.

Sources: Sonatype (Nexus Repository Pro+) · Sonatype (AI Noise blog)

3. Chainguard moves past images: Mythos bug-hunting, agent workspaces, signed CI checks and NuGet replacement

SiliconANGLE / TechTarget · October 14–15, 2026

At Assemble London, Chainguard launched four things. Chainguard Harness uses frontier models, including Anthropic’s Claude Mythos 5.1, to hunt for flaws, and reports only those it reproduces against a live build in an isolated VM with no network access. A Chainguard engineer signs off every report. It is a staff-run service with a beta waitlist, and it is listed on the Claude Marketplace, so customers can pay out of an Anthropic commit. Workspaces (beta) gives coding agents a hardened, credential-free remote VM with short-lived stand-in credentials and optional egress policy. Checks (beta) runs CI before a pull request opens and produces a signed attestation tying environment, test result and commit together. Chainguard’s Sam Katzen described Checks to TechTarget as “a replacement for GitHub Actions.” Chainguard Libraries adds Go and .NET in early access, making five languages; .NET users can swap NuGet for a Chainguard-managed endpoint with malware scanning.

TechTarget puts the launch next to Harness’s Cosmos software factory: both isolate agents in ephemeral microVMs. An IDC survey of 309 respondents found 74.6% agree AI coding assistants raise the risk of merging code nobody fully understands, yet only 28% require peer review of AI-assisted changes. IDC’s Katie Norton: “the industry is a bit over its skis.” CEO Dan Lorenc described a Workspace as an isolated machine “with nothing in it worth stealing.” Chainguard has raised about $892M since 2021.

So what for JFrog. Chainguard is no longer just a hardened-image vendor. Libraries in five ecosystems, with a managed NuGet endpoint, is a curated-registry play aimed at the remote-repository role Artifactory fills today. Checks producing signed attestations per commit overlaps directly with our Evidence story. And Harness being sold through the Claude Marketplace means Chainguard can be bought from an Anthropic budget the customer has already approved, which skips the security-tool procurement conversation we usually win on. Track every account where Chainguard Libraries shows up as a remote in Artifactory: that is the wedge.

Sources: SiliconANGLE (Chainguard at Assemble London) · TechTarget (software-factory safeguards)

4. GitHub makes agentic autofix and AI Scan GA, and puts Advanced Security on an AI-credit meter

GitHub Changelog / Help Net Security / InfoWorld · October 13–15, 2026

Agentic autofix for code scanning is now GA for GitHub Code Security and Advanced Security on Enterprise Cloud. Copilot explores the codebase, proposes a fix, reruns CodeQL to confirm the alert is closed, then opens a draft pull request; up to 25 alerts can go into one PR. When it is turned on, “Assign to Copilot” replaces the free “Generate Fix” button. Usage draws AI Credits from the Code Security budget plus Actions minutes. AI Scan for pull requests is also GA. It covers what CodeQL doesn’t, including PHP, Shell, Terraform, Dockerfiles, JSP and Blazor. Findings are advisory and cannot block a merge. It is free on public repositories, needs Code Security or GHAS on private ones, needs no Copilot licence, and also consumes AI Credits.

Separately, GitHub engineers described replacing their LLM pipeline for generic secret detection with a fine-tuned ModernBERT classifier: serving costs fell more than 98%, median scan time 86%, with precision up 13% and recall up 19%. That is the cost model behind last week’s push-protection news. Matt Asay’s InfoWorld column supplies the strategy: Stack Overflow data show AI use among developers at 83% but only 7% trusting it for important decisions, and GitHub can sell itself as the review layer over every vendor’s agents.

So what for JFrog. GitHub is moving Advanced Security from per-committer seats toward a consumption meter, and widening coverage to Terraform and Dockerfiles, which is JFrog Advanced Security ground. AI Scan with no Copilot licence lowers the bar for GHAS to spread inside accounts already standardised on GitHub. Our answer is post-build: binaries, containers and what actually shipped, plus contextual analysis that tells a team whether a CVE is applicable at all. A PR-time scanner cannot see that. Get the AI-credit pricing into the battlecard so reps can show a customer what a year of autofix costs at their alert volume.

Sources: GitHub Changelog (agentic autofix GA) · GitHub Changelog (AI Scan GA) · Help Net Security (secret-detection model) · InfoWorld (AI distrust)

5. Checkmarx joins Chainguard on the Claude Marketplace, and takes AppSec to MSPs

GlobeNewswire / ChannelBuzz · October 14–15, 2026

US Anthropic customers can now put part of their committed Anthropic spend toward three Checkmarx One products, consolidated on a single Anthropic invoice: Checkmarx Fusion, which pairs Checkmarx’s deterministic engine with Claude; Triage Assist, which ranks findings by attackability rather than static severity; and Remediation Assist, which proposes a merge-ready fix per finding. Checkmarx is also in Anthropic’s Cyber Verification Program, using Claude Mythos internally, and joined Project Glasswing in September. No pricing was given. Anthropic’s Ash Alhashim: “Security teams should be able to get the tools they trust as easily as they get Claude.”

In a ChannelBuzz interview the same week, Checkmarx channel VP Jon Kozimor called Checkmarx “a relatively small company” that relies on “hundreds” of partners, and described an AppSec Partner Program for MSPs delivering AppSec as a service, today mostly at the low end of its market.

So what for JFrog. Two AppSec competitors landed on the Claude Marketplace in one week. The marketplace turns an Anthropic commit into a procurement shortcut: a CISO can add Checkmarx or Chainguard without a new vendor onboarding or a new budget line. If JFrog is not listed, we carry full procurement friction against rivals drawn down from money the customer has already approved. Someone should own the question of whether JFrog belongs there. The MSP story is a down-market play and tells us little about Checkmarx in the enterprise.

Sources: GlobeNewswire (Checkmarx on Claude Marketplace) · ChannelBuzz (Checkmarx MSP interview)

6. A week after pitching the governed software factory, GitLab patches an unauthenticated CVSS 10 in CI

DevOps.com · October 14, 2026

GitLab’s October 12 releases fix 24 vulnerabilities. The headline is CVE-2026-97229, rated CVSS 10.0: an integer overflow in the regex compiler used by GitLab CI/CD that lets a crafted expression in CI configuration run arbitrary code on the GitLab server, without authentication. It affects 19.2 through 19.4 and is fixed in 19.4.2, 19.3.5 and 19.2.8. GitLab.com and Dedicated are already patched; self-managed instances must upgrade. High-severity CI/CD bugs in the same batch let a Developer run pipelines on protected branches (CVE-2026-16301) and expose protected variables through cache poisoning (CVE-2026-14814).

Two fixes land on the Duo Agent Platform: a prompt injection that can trigger command execution attributed to other users (CVE-2026-96893, 7.3) and a token that bypasses governance controls (CVE-2026-105458). This is GitLab’s fourth critical release in about eight weeks. Futurum’s Mitch Ashley: “Agents have turned attribution into an attack surface.”

So what for JFrog. Last week GitLab asked customers to put artifacts, a package firewall and secrets on the same platform as CI. This week that CI server shipped an unauthenticated CVSS 10 RCE and an agent-governance bypass. Use it as an argument for separation of duties, not as a gloat: the system of record for artifacts and their provenance should not be the same server that keeps needing emergency patches. Be ready for the counter-punch, too. UBS’s note this week mentioned our own August Artifactory vulnerability.

Sources: DevOps.com (GitLab CVSS 10)

7. Model labs go shopping for vulnerability hunters

BetaKit / The Next Web / CSO Online / TechCrunch · October 13–17, 2026

Cohere signed a letter of intent to buy Prague-based AISLE, about 50 people, price undisclosed, and is creating Cohere Cyber under AISLE co-founder and former Avast CEO Ondřej Vlček. AISLE claims its system found 18 of the 24 vulnerabilities fixed in the latest curl release. OpenAI is in early talks to buy Trail of Bits, according to The Information. The talks are unconfirmed and could collapse. Trail of Bits already works OpenAI’s “Patch the Planet” programme, using GPT-5.5-Cyber and Codex across 19 open-source projects including cURL, Python and Go.

Two other deals show where the money is. IonQ is paying $1.2B in stock for Elisity, a zero-trust microsegmentation vendor with more than 100 customers; analyst Frank Dickson puts that at roughly $13M per customer, and Info-Tech’s Brian Jackson says the quantum link is weaker than the announcement suggests. Pluto Security raised $42M to inventory the AI tools, skills, extensions and MCP servers employees use. Its free Plutonium service includes a catalogue of verified AI components. CEO Shahar Bahat: “We’re moving from user behavior to agent behavior.”

So what for JFrog. The labs are buying the people who find bugs with AI. Cohere has done it, and OpenAI is talking. They will sell “find and fix” directly to enterprises, which makes them a new class of competitor for the scanning half of AppSec. JFrog’s place is to be the neutral layer where any lab’s fixes land, get verified and get promoted. Pluto’s free “catalogue of verified AI components” is a small version of what JFrog AI Catalog should own outright. IonQ–Elisity has no supply-chain angle; it is a read on how richly security assets are being priced.

Sources: BetaKit (Cohere–AISLE) · The Next Web (OpenAI–Trail of Bits talks) · CSO Online (IonQ–Elisity) · TechCrunch (Pluto Security $42M)

8. Agent containment: sandboxes leak, labs skip basics, and the reference architecture names the registry

The Record / CSO Online / Socket · October 13–14, 2026

Research from AIR, reported by The Record, shows agents running in Vercel Sandbox can get data out by abusing certificate validation: a crafted certificate accepted by an approved server triggers a request to an attacker’s server, so the sandbox never contacts the attacker directly and looks normal throughout. There is no patch. AIR’s Niv Hoffman says Vercel told him a fix is unclear, and Vercel did not comment. A CSO news analysis argues that the recent run of “rogue agent” incidents at OpenAI, Anthropic, Meta, Google and Mistral are failures of basic sandboxing and egress control by the labs, not agents acting with intent. SANS’s Rob T. Lee: “There’s no reason why every single time this happens, it’s, ‘Oops, we don’t know how they got out.’”

Agent Baseline published version 1 of “The Secure Software Factory: A Reference Architecture”, co-authored by Socket CTO Ahmad Nassri with contributors from Docker, Keycard, Barclays and Secure Theory. It treats the agent as untrusted and enforces four boundaries the agent cannot reach: sandbox, network, supply chain and identity. On the supply chain, packages, dependencies and models must pass through an admission point such as a registry or supply-chain firewall. The paper cites Uber attributing more than 70% of pull requests to agents and Stripe merging more than 1,000 agent PRs a week.

So what for JFrog. The industry’s answer to agent risk is converging on one rule: the agent is untrusted, so enforce its limits outside it. The reference architecture defines the supply-chain boundary as a registry or firewall admission point, which describes Artifactory plus Curation. Socket wrote itself into that document. JFrog should be a named contributor to version 2 rather than a reader of version 1. The comment window on GitHub is open now.

Sources: The Record (Vercel Sandbox escape) · CSO Online (frontier labs skip basics) · Socket (Agent Baseline)

9. JFrog: a curl CVE from our research team, Q3 on November 5, and UBS to $125

JFrog Security Research / Business Wire / Investing.com · October 14–15, 2026

JFrog Security Research published CVE-2026-92392, a use-after-free in curl’s HTTP/2 upload path that allows client-side code execution through a malicious HTTPS server. It affects curl 8.12.0 through 8.22.0 and is fixed in 8.23.0. Full code execution needs parallel mode with an upload, which JFrog calls a “once-in-a-blue-moon scenario”, and Xray’s contextual analysis marks the finding Applicable only when HTTP/2, the relevant API call and an upload flag are all present. JFrog reports Q3 results on Thursday, November 5, after the close. UBS raised its target from $120 to $125 (Buy), expecting Q3 cloud growth of 54–55% or better against 53% in Q2. UBS said its channel checks found little evidence that the July Hugging Face incident or the August Artifactory vulnerability were slowing growth.

So what for JFrog. Notice the overlap: AISLE, now heading into Cohere, claims 18 of the 24 bugs fixed in the latest curl release, and our post covers one of them. AI-driven research shops are working the same targets as our team, at volume. Our differentiator is the contextual “does this actually apply to you” answer, so lead with that, not with CVE counts.

Sources: JFrog Security Research (curl CVE-2026-92392) · Business Wire (Q3 timing) · Investing.com (UBS target)