Summaries of public announcements, with links to the original source. Updated monthly.
ANSWER FIRST
Public announcements from the vendors we score and from standards bodies, newest first. September 2026 brought new malware controls from Semgrep, Endor Labs and OX Security, a GitHub merge block for unresolved secrets, and the start of EU Cyber Resilience Act reporting.
Editorial assessment · Compiled from vendor product, docs, pricing and marketplace pages · Rated October 2026
· Semgrep
Semgrep Supply Chain now detects malicious packages with AI-assisted rules and can trigger org-wide responses such as Jira tickets and Slack alerts. A Malware Firewall that blocks malicious dependencies before install is in private beta.
Source: Semgrep blog
· Aikido Security
Aikido Altar is a compressed, open-weight model derived from GLM-5.3. Aikido says it lets organizations run vulnerability detection and pentesting inside their own infrastructure.
Source: Aikido blog
· OX Security
OX Cloud pairs cloud security coverage with AI Detection and Response and Agentic Attack Surface Management, which track what autonomous agents can reach and what they do at runtime.
Source: OX Security blog
· Field
Manufacturers of products with digital elements must now report actively exploited vulnerabilities and severe incidents through the CRA Single Reporting Platform, with an early warning within 24 hours and a notification within 72 hours.
Source: European Commission
· GitHub
A new ruleset rule stops a pull request from merging while secret scanning alerts remain open. It is in public preview for GitHub Secret Protection and GitHub Advanced Security customers.
Source: GitHub Changelog
· Endor Labs
Threat Center tracks malicious packages in ecosystems such as npm and PyPI and maps them to a customer's projects. Package Firewall now checks VS Code extension updates against policy.
Source: Endor Labs blog
· OX Security
Dependency Vetting blocks known-malicious packages at install time and can apply cool-down periods to newly published versions.
Source: OX Security blog
· Snyk
Evo Continuous Offensive Security is generally available for AI-driven pentesting and red teaming of AI agents, and Snyk Secrets is generally available with prevention gates across coding agents, IDEs, PRs and CI/CD. A remediation agent is in public preview.
Source: Snyk newsroom
· Legit Security
VibeGuard 2.0 runs on the developer endpoint, discovers coding agents such as Claude Code, Cursor and GitHub Copilot, and adds dangerous operation blocking, command monitoring, MCP security and anti-tampering.
Source: Legit Security press release
· Field
In the current Model Context Protocol revision, each request declares its protocol version, and a server/discover call returns a server's supported versions and capabilities.
Source: Model Context Protocol
· Snyk
Evo Agentic Development Security governs AI agents across the development lifecycle: it secures MCP servers, monitors agent behavior and validates generated code. Snyk set general availability for 29 June 2026.
Source: Snyk newsroom
· Legit Security
Legit's Agentic AppSec uses remediation agents that prioritize and fix SAST and SCA findings, then re-scan to confirm each fix.
Source: Legit Security blog
· GitHub
GitHub said npm v12, expected in July 2026, will not run dependency install scripts unless they are approved with npm approve-scripts, and will require explicit flags for git and remote URL dependencies.
Source: GitHub Changelog
· Cycode
AI Guardrails intercepts secrets in prompts, file reads and MCP tool calls before they leave the IDE. Cursor and Claude Code were supported at launch.
Source: Cycode blog
NOTE
News items summarize what each company or body published. They are not part of the scores until the next quarterly review. To suggest a correction or an item, email editors@bestaicodesecurity.com.