April 2025 Summaries

The rapid adoption of AI coding assistants like GitHub Copilot and Cursor has significantly increased code velocity, with over 40% of code now AI-generated, a figure expected to rise to 80%. However, this surge presents challenges for application security (AppSec), as 62% of AI-generated code contains bugs or security vulnerabilities, and 30% includes known security weaknesses. Traditional AppSec tools, such as static application security testing (SAST) and software composition analysis (SCA), are ill-equipped to address the unique design flaws introduced by AI-generated code, which often does not conform to existing vulnerability databases like CVEs or CWEs. Endor Labs offers a solution tailored for AI-native software development, integrating directly into AI tools to detect and rectify security risks at the source before code is committed. Their platform employs AI agents to conduct security reviews that encompass architectural changes and design flaws, offering prioritized insights to focus on impactful pull requests. By leveraging a comprehensive dataset of open-source code, Endor Labs enhances early risk detection and ensures developers can maintain their workflow without added friction, providing a sophisticated approach to securing AI-generated code from inception.

Endor Labs, a rapidly growing company led by repeat entrepreneur Varun, has achieved a 30-fold increase in Annual Recurring Revenue (ARR) over the past 18 months, with a 166% Net Revenue Retention. The company has successfully positioned itself as a leader in application security, protecting over 5 million applications through more than a million weekly scans, and partnering with forward-thinking companies such as Rubrik and People.ai. Despite market volatility, Endor Labs has secured $93 million in a Series B funding round led by DFJ Growth, with participation from Salesforce Ventures, to further its mission of addressing the challenges posed by the scale and complexity of modern software development. This funding will enable the company to expand its engineering team, enhance its comprehensive security dataset, and evolve its platform to support AI-native security workflows. With a focus on long-term impact, Endor Labs is poised to become a foundational force in the software development revolution, driven by its strong product-market fit, strategic partnerships, and the expertise of its team, including PhD-level specialists in program analysis and AI.

Endor Labs has launched AI Security Code Review, an advanced tool designed to assist application security teams in moving beyond traditional vulnerability management by addressing both false positives and false negatives in security assessments. Built upon Endor Labs’ next-generation platform, it employs multiple AI agents to analyze pull requests for security-impacting design flaws and architectural changes. Unlike conventional tools that rely on static rules and signatures, this system uses contextual understanding to identify critical security risks, such as unauthenticated API endpoints or altered authentication flows, that might be missed by rule-based approaches. The AI agents work in tandem to assess code changes, categorize them by security domain, and prioritize them based on potential impact, providing detailed insights for security teams. As AI-generated code becomes more prevalent, this tool aims to detect subtle security issues that emerge from rapid development environments, offering a scalable solution for modern application security challenges and integrating with existing source code management tools and project management systems.

The whitepaper "AI Security Code Review: A Multi-Agent Approach for Detecting Security Design Flaws at Scale" explores the capabilities of AI-driven code review technologies, emphasizing their role in identifying security design flaws within AI-native software development. It outlines the integration of these tools into existing workflows and highlights their potential to replace traditional code scanning methods with more sophisticated solutions that accommodate the complexity and speed required by modern software development. Additionally, the text references related topics such as the impact of breaking changes on security and critical vulnerabilities like CVE-2026-25896 and CVE-2025-4641, offering insights into assessing and mitigating potential risks in software systems.

AI coding assistants are revolutionizing how developers write code, but existing security tools have lagged behind, prompting the creation of the Endor Labs MCP Server. This server acts as a bridge between the Endor Labs AppSec platform and AI-native IDEs like GitHub Copilot, VSCode, and Cursor, providing the necessary context for AI tools to not only identify risks but also effectively address them. The MCP, or Model Context Protocol, standard enables AI agents to query backend tools for assistance, enhancing their ability to detect vulnerabilities, exposed secrets, and risky dependencies. Unlike traditional tools that focus on detection, the MCP Server prioritizes precise fixes by offering context-rich findings and upgrade insights, surpassing mere LLM guesswork. This innovation aligns with the shift towards "vibe coding," where AI-driven development practices are prevalent. As software is increasingly written with AI editors, the importance of integrating comprehensive security measures into this new workflow has become crucial, and Endor Labs aims to secure this evolving landscape by expanding its AppSec platform and introducing an agentic AI layer to better accommodate AI workflows.

Endor Labs has announced a significant expansion of its application security platform alongside a $93 million Series B funding round, focusing on addressing the challenges posed by AI-generated code. The new platform architecture incorporates an agentic AI framework and deep insights into open-source code, launching capabilities such as AI Security Code Review and the Endor Labs MCP Server. These tools aim to aid Application Security (AppSec) teams by enabling early detection and resolution of vulnerabilities in AI-generated code, integrating seamlessly with AI coding assistants like GitHub Copilot and Cursor. As AI-generated code becomes increasingly prevalent, constituting a significant portion of software development, AppSec teams face the challenge of managing a growing volume of security alerts. Despite the risks associated with AI-generated code, such as design flaws and security vulnerabilities, many organizations have adopted AI coding tools to boost productivity. Endor Labs' platform strives to transform this challenge into an opportunity by embedding security analysis directly into developer workflows, thereby facilitating secure AI adoption and maintaining developer productivity. The platform leverages a comprehensive graph of application dependencies, a rich dataset of vulnerability data, and persistent memory to provide contextually aware and precise security recommendations, emphasizing the importance of open-source expertise in AI code security. This approach allows for real-time security insights during code generation, enhancing collaboration between security and engineering teams and significantly reducing the time required to address vulnerabilities.

A critical security vulnerability identified as CVE-2025-30065 has been found in Apache Parquet's Java library, specifically within the parquet-avro module, and has been rated as "Critical" with a CVSS score of 10.0. This flaw, classified as Deserialization of Untrusted Data (CWE-502), poses serious risks to systems that import Parquet files from untrusted sources, potentially allowing attackers to gain remote code execution, steal or tamper with data, install malware, or disrupt services. All systems using Apache Parquet Java library versions 1.15.0 or earlier are considered vulnerable, with the issue reportedly introduced in version 1.8.0. Although there have been no known reports of active exploitation as of early April 2025, the public awareness of the vulnerability suggests that attackers may develop exploits. Immediate action is advised, including upgrading to version 1.15.1 or later, avoiding or validating untrusted Parquet files, and enhancing monitoring and logging to detect suspicious activities. Organizations are urged to stay informed about further advisories and updates from Apache or other cybersecurity authorities to mitigate the risk effectively.

Endor Labs aims to enhance application security accuracy by improving Software Composition Analysis (SCA) and Static Application Security Testing (SAST), helping organizations determine if Application Security Posture Management (ASPM) is suitable for their needs. The blog post, authored by Andrew Stiefel and published in 2025, emphasizes reducing noise and focusing on essential security issues, promising advancements in AppSec practices for organizations considering their security strategies.