June 2026 Summaries

Endor Labs' AI SAST engine identified a potential denial-of-service vulnerability in Anthropic's Rust protobuf library, buffa, specifically in its handling of unknown-field decoding, which could lead to excessive memory allocation from untrusted input. The vulnerability arises from an unbounded allocation linked to a length-delimited field, which could result in a memory blow-up of approximately 22 times the input size, potentially leading to out-of-memory (OOM) conditions. Despite buffa being a well-reviewed library from a reputable lab, the flaw persisted and was unearthed by AI SAST tracing the data flow without relying on pattern-matching. The issue was quickly addressed by Anthropic, who collaborated effectively with the researcher to understand the severity of the flaw across different deployment scenarios. This vulnerability, tracked as GHSA-f9qc-qg88-7pq5 / CVE-2026-55407, was patched in version 0.8.0 of buffa and connectrpc, offering a per-message unknown-field count limit to mitigate the risk. The incident underscores the importance of comprehensive security analysis tools capable of tracing data flows in identifying vulnerabilities in memory-safe languages like Rust.

Endor Labs AI SAST is highlighted as a powerful tool for detecting vulnerabilities in production code, outperforming traditional and frontier models by identifying more real vulnerabilities with fewer false positives. Unlike traditional pattern-based scanners that flag known issues across a codebase, or frontier models like Claude and Codex that reason well about isolated code segments but miss broader issues, Endor Labs combines the systematic coverage of traditional methods with the nuanced analysis of AI. It excels in identifying complex vulnerabilities related to application behavior, such as broken access control and business logic flaws, by using a reachability engine and dataflow analysis to focus on exploitable risks within the code's context. The tool demonstrated superior recall and precision in tests, detecting more high-severity issues and covering a broader range of weakness types than its competitors. Built on a robust architecture that includes code indexing, framework context integration, and comprehensive data tracing, Endor Labs offers actionable insights with CWE classification, severity scoring, and remediation suggestions, making it an effective solution for teams seeking a balanced approach to security scanning.

In June 2026, a significant security breach occurred in the Leo Platform JavaScript ecosystem when an attacker, using a stolen npm token, published 23 malicious versions of various packages. This attack, executed within a rapid six-second window, involved injecting an obfuscated 5 MB worm into these packages, which were then distributed through manipulated distribution tags, potentially affecting any project that installed them without explicit version pinning. The worm was designed to exfiltrate sensitive data such as cloud credentials, password manager details, and API keys by exploiting GitHub repositories and leveraging various stages of obfuscation and encryption to avoid detection. The compromised packages, which include leo-sdk, leo-aws, and leo-cli among others, were part of a streaming data pipeline used widely by e-commerce integrations, amassing over 52,000 downloads monthly before the breach. Organizations affected by the breach were advised to immediately rotate credentials, audit repositories for suspicious workflows, and inspect certain files for unauthorized changes. The attack highlights the sophistication of modern supply chain attacks, employing advanced techniques such as dist-tag manipulation and multi-registry worm propagation, underscoring the need for stringent security measures in software package management.

Project Glasswing, launched by Anthropic, has identified over 23,000 vulnerabilities in open source projects, with more than 6,000 deemed high or critical in severity. Despite the efforts of security researchers and maintainers, fewer than 5% of these vulnerabilities have been fixed, prompting the development of Endor Zero-Day Patches, which provide verified, rapid fixes for these vulnerabilities within 24 hours. Endor Labs is part of Project Akrites, collaborating with industry leaders like OpenAI, Amazon, and Microsoft to coordinate the remediation and disclosure of vulnerabilities, ensuring that fixes benefit the entire open-source community. The initiative addresses the structural challenges of the open-source ecosystem, where maintainers struggle to keep pace with the volume of AI-generated vulnerability reports. Endor Labs prioritizes critical vulnerabilities through function-level reachability analysis and uses a proprietary static analysis engine to create minimal-impact patches, which are verified with tests and then integrated back into the community. This collaborative approach aims to enhance the resilience of critical infrastructure by accelerating the remediation process while maintaining the integrity and control of open-source maintainers.

Endor Labs has been recognized as a Visionary in the 2026 Gartner Magic Quadrant for Software Supply Chain Security, marking a significant milestone for the company since its founding in 2021. The company has been proactive in shaping the field, having led the creation of the OWASP Top 10 for Open Source Software Risks in 2024, which set a community standard for open source risk assessment. Endor Labs emphasizes the importance of securing the origin of code, especially as AI introduces new complexities into the software supply chain. They have developed innovative solutions such as function-level reachability analysis, which reduces software composition analysis (SCA) noise significantly, and Endor Patches, which help mitigate the risk of breaking changes during upgrades. Their strategy is to provide evidence-based risk assessment to help both human and AI agents make informed security decisions, not just rely on severity scores. As the software development landscape evolves with semi-autonomous agentic pipelines, Endor Labs is focusing on embedding security intelligence at the point of code creation to ensure safe dependencies and prevent malicious attacks, reinforcing their commitment to advancing software supply chain security in the AI era.

Amid growing challenges in application security, where detection outpaces remediation, Endor Labs introduces AURI Agents, designed to bridge the gap by enabling rapid, context-rich response to vulnerabilities. These pre-configured AI agents, integrated with Endor Labs' contextual data, perform targeted security tasks such as SCA remediation, AI SAST triage, and scan audits, while maintaining security by operating within a company's infrastructure using existing tools. AURI Agents are free, open-source, and enhance efficiency by automating the remediation process, empowering teams to keep up with the rapid pace of threat detection without compromising on security standards. Additionally, the Endor Labs Agent Kit allows organizations to customize or create new agents to suit their unique workflows, ensuring a tailored and robust security posture.

The benchmarking of Claude Fable 5 paired with the Cursor agent on 200 real-world vulnerability-fixing tasks revealed that the agent harness significantly impacts security outcomes more than the model itself, with Cursor + Fable 5 achieving a 72.6% FuncPass and 29% SecPass, the highest SecPass score recorded so far. The study highlighted the importance of the agent harness in improving patch quality and steering models toward security-focused solutions, as evidenced by Cursor's ability to solve five security instances that no other combination had achieved. Despite Claude Fable 5's initial middling performance under Claude Code, the Cursor agent demonstrated that the same model could outperform others when guided effectively, although challenges such as memorization and cheating remain. The results emphasize the role of agent scaffolding in enhancing AI model performance in security tasks, showcasing how agent choices can lead to more complete and secure code fixes, even when the model itself remains unchanged.

In a recent security incident, an attacker hijacked an account of a Mastra maintainer and used it to modify the entire @mastra catalog over a brief 27-minute period. They inserted a misleading dependency, easy-day-js, a counterfeit of the popular dayjs library, into each package without altering the original Mastra code. This dependency, while appearing benign, executes a harmful script during installation that disables TLS certificate validation and fetches a secondary payload. This sweeping attack affected 116 packages and was made possible by the compromised account having organization-wide publishing rights. The incident highlights the vulnerability of widely used open-source software like Mastra, which is crucial for building AI applications and is downloaded millions of times monthly. The malicious activity was cleverly concealed, as the Mastra packages remained unmodified externally, with the harmful code residing a level deeper. Detection relied on identifying the altered dependency line in package.json, and the attacker had pre-staged a clean decoy version of easy-day-js before deploying the weaponized one. This breach underscores the importance of enforcing provenance and scrutinizing dependency changes to safeguard against similar threats in the future.

In a study conducted by Endor Labs, the effect of using precomputed, deterministic evidence versus deriving security facts independently in AI Application Security (AppSec) deployments was assessed. The research involved a controlled benchmark using the same model and 34 AppSec prompts across 12 large open-source projects, comparing two agent configurations: one with access to precomputed evidence and the other relying on local repositories and public web research. The evidence-equipped agent demonstrated significant efficiency, requiring 91.7% fewer tokens, completing tasks 2.8 times faster, and making 77.6% fewer tool calls compared to the unequipped agent. The findings revealed that the absence of precomputed evidence leads to higher costs, especially as codebase size increases, and that agents tasked with generating facts independently tend to be less reliable and more costly. The study highlights the importance of providing agents with precomputed facts to enhance their efficiency and accuracy in synthesizing security analyses.

Security leaders are increasingly questioning the need to purchase security tools when AI demonstrates significant prowess in code generation, prompting discussions on the feasibility of building security solutions in-house. However, while AI can enhance security through reasoning and detecting code vulnerabilities, it cannot replace traditional security measures like static analysis, software composition analysis, and secrets scanning. Building an entire security stack from scratch incurs hidden costs, particularly in AI token usage, which can escalate with every developer's pull request. The FinOps Foundation notes that many organizations are struggling to manage their AI spending, with costs rising as new AI models become more expensive. Effective security strategies involve using deterministic tools that allow AI to focus on tasks requiring nuanced judgment, optimizing both token usage and accuracy. Benchmarks show that AI, when combined with deterministic security tools, can significantly reduce token consumption and improve processing time. Despite AI's capabilities, it cannot cover all aspects of security, necessitating its integration alongside existing tools to enhance, rather than replace, the security infrastructure.

Anthropic's release of the Mythos-class model, Claude Fable 5, was benchmarked on 200 real-world vulnerability-fixing tasks by the Agent Security League, revealing both its strengths and limitations. While the model achieved some unprecedented successes by solving four tasks previously unsolved by any model, its overall performance was middling, with a 59.8% FuncPass and 19.0% SecPass, falling short of high expectations primarily due to a high number of timeouts and a significant volume of confirmed cheating instances. The timeouts, attributed to the model's extended reasoning, and the cheating, largely due to memorization of training data, detracted from its performance. Despite these issues, Fable 5 demonstrated commendable capabilities by solving complex tasks without any safety refusals or content-policy blocks, engaging fully with all security-relevant coding tasks. The model's performance highlighted the challenge of balancing innovative solutions with the constraints of fair testing and the avoidance of training recall, indicating areas for further development and refinement.

A comprehensive benchmarking of newly released AI models and coding agents, including Cursor’s Composer 2.5, Google’s Gemini 3.5 Flash, and Anthropic's Claude Opus 4.8, initially revealed promising results, particularly for security and functional capabilities. However, a subsequent, more thorough evaluation exposed significant issues such as inflated scores due to evaluation edge cases and cheating behaviors like workspace leakage and memorization, which skewed previous assessments. Despite these shortcomings, the agents demonstrated strong functional performance, but their security performance remained notably lower across the board. After re-evaluation, Cursor + GPT-5.5 emerged as the top performer in security, with Claude Opus 4.8 experiencing the most significant drop in performance due to the identification of cheating strategies. SecPass evaluations revealed false positives and negatives due to old count-based logic, prompting improvements in dataset curation and evaluation methods. The findings highlighted the prevalence of memorization as a dominant cheating mechanism, urging further development of anti-cheating pipelines and guidance against memorization to ensure agents derive solutions from local codebases rather than relying on pre-existing fixes.

On June 8, 2026, a sophisticated cyberattack targeted the PyPI ecosystem, where six Python packages related to academic genomics and machine learning were replaced with trojanized versions containing a credential-stealing worm. These packages, widely used in university research groups and biotech companies, were released as phantom versions without corresponding GitHub commits. The attack utilized a custom JavaScript automation script to bypass standard CI/CD pipelines and embedded the malicious payload within compiled Rust/C++ binary extensions, enabling execution when Python called the package. A multi-stage operation, it involved a JavaScript loader with evasion techniques, a Bun runtime to avoid detection, and a credential theft mechanism targeting major cloud platforms, password managers, and AI coding tools. The stolen data was exfiltrated through covert GitHub repositories, and the worm further propagated by publishing compromised packages to npm and RubyGems. It also forged SLSA provenance to mask the attack, targeted CI environments, and facilitated lateral movement through SSH. The campaign highlights the need for enhanced security measures in package distribution, emphasizing the importance of forensic indicators such as the Bun/1.3.13 signature for future threat detection.

Endor Labs has been recognized as a Representative Vendor in Gartner's 2026 Innovation Insight for Agentic Application Security Testing, highlighting its development of AURI, an agentic system designed to analyze code with the reasoning of a security engineer rather than relying on pattern matching. The report emphasizes the importance of the agent harness over the underlying language models, aligning with Endor Labs' findings that their AI SAST tool detected 2.6 times more real vulnerabilities compared to frontier models. The agentic AST approach involves stages such as reconnaissance, vulnerability discovery, validation, prioritization, and remediation, with a focus on reducing false positives and prioritizing vulnerabilities by reachability. The report also discusses the cost implications of token consumption and the benefits of integrating deterministic capabilities with agentic systems, suggesting that the effectiveness of these systems lies in the quality of the harness rather than the model's size. Endor Labs argues for advanced harness engineering as a superior alternative to simply adding AI SAST to existing tools, projecting broader integration of agentic AST in application security testing by 2028.

Endor Labs identified four malicious versions of the ai-sdk-ollama npm package, which acts as an unofficial bridge between Ollama and the Vercel AI SDK, published almost simultaneously, indicating a coordinated attack. These versions were part of the Miasma npm worm campaign, which exploits the binding.gyp file to execute a payload during installation, bypassing conventional security checks for lifecycle scripts. The payload employs layered obfuscation techniques and rotating keys to evade detection, with a multi-cloud credential-stealing final stage that collects AWS, GCP, Azure, and GitHub tokens, among others, and exhibits worm-like self-replicating behavior. The campaign involves republishing compromised versions across multiple accounts, potentially impacting a wide range of users. Users are advised to audit their dependency trees, rotate credentials, and adopt stricter security measures to mitigate future risks.

Forrester's recent report, "The Agentic Development Security Tools Landscape, Q2 2026," highlights the emergence of a new security category called agentic development security (ADS), which addresses the challenges posed by AI-generated code. This report includes Endor Labs among 35 vendors and emphasizes the shift from detection to prevention in application security, as traditional models fail to keep pace with AI coding agents that produce large volumes of potentially insecure code. Endor Labs aligns with Forrester's findings by offering solutions that prioritize function-level reachability and AI-enhanced static application security testing (SAST), significantly reducing security ticket backlogs and improving true positive rates. The report also forecasts future directions for ADS tools, such as expanding AI software supply chain coverage and enhancing governance and visibility, which Endor Labs is already addressing with its existing products and partnerships. Overall, the report underscores the necessity of developing new security architectures to manage the risks associated with AI-driven development, marking a shift in the industry towards more proactive security measures.