AI code security news recap: June to September 2026

This recap is written from the dated items on our news page plus a few items we track but did not list there. It covers announcements from June to September 2026, as published on the vendors' and standards bodies' own sites. It summarizes what each company said; it is not an assessment of how well any product works, and none of these items has changed our scores yet. The next quarterly review will look at them.

1. Controls on the coding agent

Three of the vendors we score shipped or extended products that act on the agent rather than on its output. On 23 June Snyk added Agentic Development Security to Evo, to govern AI agents across the development lifecycle by securing MCP servers, monitoring agent behavior and validating generated code, with general availability set for 29 June. On 3 August Legit Security launched VibeGuard 2.0, which runs on the developer endpoint, discovers coding agents such as Claude Code, Cursor and GitHub Copilot, and adds dangerous operation blocking, command monitoring, MCP security and anti-tampering. On 9 September OX Security added Dependency Vetting to OX VibeSec, which inspects each package install an AI agent attempts.

The direction is clear from the dates: the control point is moving from the repository toward the machine where the agent runs. The question in our buyer's checklist about where enforcement happens matters more after this quarter than before it.

2. Malicious packages and install time

The largest cluster of announcements was about packages. On 9 June GitHub announced that npm v12 will stop running dependency install scripts by default unless they are approved with npm approve-scripts, and will require explicit flags for git and remote URL dependencies. On 9 September Endor Labs launched Threat Center, which tracks malicious packages across ecosystems such as npm and PyPI and maps them to a customer's projects, and extended its Package Firewall to VS Code extension updates. The same day, OX VibeSec's Dependency Vetting added blocking of known-malicious packages and cool-down periods for newly published versions. On 24 September Semgrep added AI-assisted malicious package detection to Semgrep Supply Chain, with policies that can open Jira tickets or send Slack alerts, and a Malware Firewall in private beta.

Our note on npm v12 install scripts explains what the npm change covers and what it leaves to install-time package checks.

3. Secrets before the merge

On 4 August Snyk made Snyk Secrets generally available, with prevention gates across coding agents, IDEs, pull requests and CI/CD. On 9 September GitHub added a ruleset rule, in public preview for GitHub Secret Protection and GitHub Advanced Security customers, that blocks a pull request from merging while secret scanning alerts remain unresolved. Both move secrets checks from reporting toward blocking. Our lesson on secrets from the IDE to the merge puts the checks in order.

4. Agents that write the fix

On 16 June Legit Security introduced Agentic AppSec, with remediation agents that prioritize and fix SAST and SCA findings and then re-scan to confirm the fix. On 4 August Snyk put a remediation agent into public preview through its CLI. On 9 September GitHub made agentic autofix generally available for Code Quality findings, and on 25 September it began storing fix patterns in Copilot Memory for customers who have it enabled. Our note on agentic remediation compares what each fix agent does and where its changes land.

5. AI-driven testing and agents in production

Some announcements looked past the code. On 28 July Semgrep released nine agentic workflows in public beta that combine program analysis with AI reasoning to hunt for classes such as SQL injection, XSS, SSRF and command injection, covering 70+ CWEs. On 4 August Snyk made Evo Continuous Offensive Security generally available for AI-driven pentesting and red teaming of AI agents. On 16 September OX Security launched OX Cloud, which pairs cloud security coverage with AI Detection and Response and Agentic Attack Surface Management to track what autonomous agents can reach and do at runtime. The same day GitHub said its AI Scan, which finds vulnerabilities in pull requests, no longer requires CodeQL default setup; it is in public preview for repositories on github.com with GitHub Advanced Security. On 21 September Aikido Security released Altar, an open-weight security model derived from GLM-5.3, which Aikido says lets organizations run vulnerability detection and pentesting inside their own infrastructure.

6. Standards and regulation

Two changes affect every vendor. The Model Context Protocol specification dated 2026-07-28 became the current version; each request now declares its protocol version, and a server/discover call returns a server's supported versions and capabilities. From 11 September 2026, the EU Cyber Resilience Act requires manufacturers of products with digital elements to report actively exploited vulnerabilities and severe incidents through the CRA Single Reporting Platform, with an early warning within 24 hours and a notification within 72 hours. Our lesson on the CRA and NIST SSDF covers both frameworks.

All items in date order

Sources

1. GitHub Changelog: upcoming breaking changes for npm v12 github.blog
2. Legit Security: Agentic AppSec legitsecurity.com
3. Snyk: Evo Agentic Development Security launch snyk.io
4. Model Context Protocol: versioning modelcontextprotocol.io
5. Semgrep: agentic workflows semgrep.dev
6. Legit Security: VibeGuard 2.0 press release legitsecurity.com
7. Snyk: Evo Continuous Offensive Security and Snyk Secrets snyk.io
8. GitHub Changelog: block pull requests with exposed secrets github.blog
9. GitHub Changelog: remediate Code Quality findings with agentic autofix github.blog
10. Endor Labs: Threat Center and Package Firewall endorlabs.com
11. OX Security: Dependency Vetting ox.security
12. European Commission: CRA reporting obligations digital-strategy.ec.europa.eu
13. OX Security: OX Cloud launch ox.security
14. GitHub Changelog: AI Scan no longer requires CodeQL default setup github.blog
15. Aikido Security: Altar aikido.dev
16. Semgrep: malware detection and response semgrep.dev
17. GitHub Changelog: agentic autofix now uses Copilot Memory github.blog

Related on this site

• AI code security news
• npm v12 install script defaults
• Agentic remediation
• Best AI code security tools