JFrog: AI Coding Tools Are Generating Vulnerabilities 10 Times Faster Than They're Being Fixed
JFrog's 2026 report: AI coding tools add about 35 CVEs a month as disclosures rose 92% in 2025, and CISA now advises against severity-only vulnerability triage.
JFrog at swampUP 2026: Agents Are Now Supply Chain Actors, Not Just Tools
JFrog unveiled APM repositories, prompt-to-release traceability, and zero-touch remediation at swampUP 2026 — extending supply chain governance to autonomous AI agents.
Coding Agents Are Pulling Packages Your Security Team Can't See
AI coding agents like Cursor and Claude Code bypass traditional package governance by pulling dependencies directly from public registries. JFrog's agent package resolution closes that gap before the next supply chain incident.
Agent Immunization: The Software Supply Chain Security Model Built for AI Speed
JFrog's agent immunization framework embeds trust enforcement inside what AI agents consume—not at the perimeter—because perimeter security cannot keep pace with agentic development velocity.
JFrog Fly Graduates: What an Agentic Repository Actually Means for Enterprise CI/CD
JFrog Fly's agentic repository capabilities are now part of the main JFrog Platform. The experiment is over. The question now is what enterprise teams do with it.
How Bedrock AgentCore Propagates User Identity to JFrog Artifactory — and Why It Matters
When an AI agent calls a tool on behalf of a user, who gets the audit trail? Bedrock AgentCore's On-Behalf-Of token exchange solves the shared-credential problem that makes agent-to-Artifactory calls untrustworthy.
AI Just Found a 27-Year-Old Vulnerability. Your AppSec Stack Wasn't Built for This Speed.
Claude Mythos Preview independently found and weaponized a 27-year-old OpenBSD flaw, a 16-year-old FFmpeg bug, and a 17-year-old FreeBSD RCE. JFrog's analysis explains why fragmented security tooling can't keep up.
Scale Your Platform Without Becoming the Bottleneck: The JFrog Projects Framework
Growing engineering orgs hit a wall when centralized platform admins become the constraint. JFrog Projects introduces delegated administration, project-scoped RBAC, and isolation by default — with a model that scales to 120,000+ repos.
JFrog Artifactory and GCP Artifact Registry: Native Pull, No Sync Required
JFrog's Artifact Registry Connector routes Cloud Run and GKE pulls directly to Artifactory in real time — eliminating sync lag, parallel registries, and policy enforcement gaps.
Agentic Dev Security Starts Before the Agent Writes Its First Line
JFrog's Ohad Shalev argues most agentic development security tools watch what agents build but miss what they consume before they start — and that gap is where the real attack surface lives.
SLSA and DevGovOps: Why Software Supply Chain Governance Now Runs at Machine Speed
AI agents generate code faster than human governance frameworks can review it. DevGovOps — continuous governance embedded in CI/CD — is the response, and SLSA provides the maturity model. Here's how JFrog's implementation works.
swampUP 2026: JFrog's Conference Puts AI Supply Chain Trust at the Center
swampUP 2026 in New York (September 1–3) focuses on immunizing, healing, and governing the agentic software supply chain. Anthropic's Deputy CISO, NVIDIA, AWS, and Wiz are on the agenda. Here's what to expect.
JFrog's Agent Guard Targets the MCP Servers Nobody in Security Approved
36% of MCP servers and agent skills tested carry a security flaw. JFrog's Agent Guard adds an approved-only proxy so developers can't connect coding agents to ungoverned tools.
An OpenAI Model Found a Zero-Day in Artifactory. JFrog Patched It Fast.
OpenAI's models autonomously chained vulnerabilities to escape a sandbox and reach Artifactory infrastructure — a preview of what 'AI as attacker' means for patch response times.
Model Routing Promises 85% Savings. One Switch Can Erase All of It.
JFrog's research shows model routing cuts AI agent costs by 40-85% — but a single mid-session model switch can cost more than the savings it was meant to create.
NuGet Typosquat: How One Extra Letter Rigged a Betting Platform's Odds
JFrog uncovered Newtonsoftt.Json.Net, a typosquatted NuGet package that patched a betting platform's game logic to rig crash-game outcomes on a schedule only the attacker knew.
DevGovOps: The Compliance Framework AI-Speed Development Actually Needs
AI agents commit 10–50x faster than human developers. EU DORA compliance requires continuous proof of controls. DevGovOps is the framework that reconciles the two.
AI Agents Now Have a Package Manager — and JFrog Is the Enterprise Registry
APM (Agent Package Manager) treats agent primitives like versioned software packages. JFrog's Artifactory adds native support, bringing supply-chain governance to AI agent configuration.
JFrog Boost: The Free CLI That Cuts AI Coding Token Bills Before You Hit the Limit
JFrog Boost enters public preview with 80% payload reduction in CI scenarios—addressing the token-cost problem quietly becoming every platform team's biggest AI line item.
CVE Severity Scores Are Inflated: JFrog's 96% Finding
JFrog's security team found 96% of critical CVEs warranted a lower rating. Their prototype pollution research exposes why CVSS scores routinely misrepresent real-world exploitability.
Why Uniform AI Agent Governance Fails — and What to Do Instead
Gartner projects 40% of enterprises will demote or decommission AI agents by 2027 due to governance failures. JFrog's analysis of why one-size-fits-all governance breaks down, and the tiered alternative.
JFrog Artifactory Adds Xet Protocol Support: How Enterprise Model Distribution Finally Scales
JFrog Artifactory's native Xet protocol support brings chunk-level deduplication to Hugging Face model distribution — delivering up to 3.7x faster subsequent pulls and controlled storage growth for enterprises managing fine-tuned model variants.
JFrog Brings Artifact Governance to Coding Agent Plugins
JFrog Agent Plugins Repositories treats coding agent plugins as governed software artifacts in Artifactory — closing the supply chain gap where Claude Code, Cursor, and Codex plugins arrive from uncontrolled GitHub repos and Slack channels.
PixelSmash: The FFmpeg Heap Overflow That Turns Media Files Into Attack Vectors
CVE-2026-8461 is a CVSS 8.8 heap out-of-bounds write in FFmpeg's MagicYUV decoder — enabled by default, triggerable without user interaction, and already demonstrated as RCE against Jellyfin and Nextcloud.
JFrog Named a Leader in the First-Ever Gartner MQ for Software Supply Chain
JFrog placed highest for Ability to Execute in the inaugural Gartner Magic Quadrant for Software Supply Chain Platforms — the first analyst framework to evaluate this market as a unified category.
npm v12's Biggest Security Change: Installation Scripts Now Need Your Permission
npm v12 disables lifecycle scripts, Git dependencies, and remote URL resolution by default — an explicit trust model that blocks 53% of malicious npm attacks and requires teams to audit their CI/CD pipelines before upgrading.
AI Writes Rego Fast. JFrog's AppTrust Playground Validates It Against Real Artifacts.
OPA dominates policy-as-code at 62% of all policy files. AI tools generate it in seconds. JFrog's Policy-as-Code Playground closes the gap between AI-generated Rego and production-safe policy.
JFrog Brings Xray Security Data Into Amazon Kiro With a New Open-Source Power
JFrog Power for Kiro adds artifact search, repository management, and live CVE data from JFrog Xray directly into Kiro's MCP-native IDE — closing the gap between AI-assisted coding and security validation.
JFrog's Claude Code Plugin Puts Supply Chain Security Where AI Decisions Happen
JFrog embeds dependency validation, MCP server governance, and Artifactory access directly into Claude Code—shifting supply chain security left into the agentic development loop.
JFrog Just Put NVIDIA NIM Models Into Your Software Supply Chain
NVIDIA NIM inference microservices used to bypass organizational supply chain controls entirely — pulled directly from NVIDIA's NGC registry with no versioning, scanning, or audit trails. JFrog AI Catalog now treats NIM models as governed artifacts alongside every other dependency.
JFrog's MCP Integration: Ask Your Platform to Provision Itself
JFrog's new MCP server lets AI coding agents like Cursor and Claude Code provision Artifactory repos, run Xray security scans, and trace release bundles — in plain language, without navigating dozens of UI screens.
JFrog's AI Asset Detection: Why Shadow AI Is the New Shadow IT
Coding agents are pulling MCP servers, models, and AI-generated code into your pipelines without approval. JFrog's detection framework classifies four categories of AI assets and explains how to build a continuous inventory before they become supply chain risks.
JFrog's Package Traffic Controller Closes the Last Open Door in Supply Chain Security
AI agents bypass artifact repos entirely. JFrog's new network-layer tool intercepts every outbound package request — developers, agents, and everyone else — and routes it through curation policy.
The AI Governance Illusion: 97% of Teams Think They're Covered — and Aren't
JFrog found 97% of orgs claim AI model governance while 495 malicious models sat on Hugging Face. The confidence-reality gap is the real security risk.
JFrog MCP Registry: Governing AI Agents at the Tool Level
JFrog MCP Registry enforces AI agent permissions at tool level, not server level — giving Google Cloud teams governed self-serve MCP access without accepting blind security risk.
JFrog + SageMaker: Building the Governed AI Model Supply Chain That S3 Can't
Integrating JFrog Artifactory with AWS SageMaker closes the governance gap in AI model pipelines — AIBOM generation, Hugging Face curation proxy, and immutable versioning replacing unstructured S3 buckets.
JFrog Skills: Open-Source Toolkit for AI Agents That Understand Software Supply Chains
JFrog's open-source Platform Skills library lets AI agents query CVE data, verify artifact provenance, and enforce governance policies using natural language — with MCP support for Cursor and Claude Code.
AI Supply Chain Governance: Why Model Safety Isn't Enough
JFrog's 2026 analysis shows why AI model safety and trusted AI governance are two different things — and why most enterprises haven't closed the gap.
JFrog Curation: How Compliant Version Selection Stops Policies From Breaking Builds
JFrog's Compliant Version Selection routes blocked packages to the highest policy-compliant version — keeping builds green without relaxing security controls.