We spent a month targetting AI security agents at our own code. We are a security company. Composition analysis, vulnerability scanning and secret detection already in CI. The agents found high-severity bugs anyway.

Observability of agents is one thing; extending and governing their behavior is another. Take a look at our current thinking on what session collection will look like in this write-up by our core engineer @javirln chainloop.dev/blog/anthropic…

Today we open-sourced our collector for AI coding sessions. We built @chainloop_dev as the governance layer for an automated SDLC. Since then, the industry is quickly evolving to the agentic SDLC; the foundational premise is the same, but the scale and surface have changed.

Our engineers turned a codebase's own security-fix history into a map of where its next bug is likely to be. Worth reading if you run an AppSec program and your scanners only find known CVEs. chainloop.dev/blog/predictin…

We are testing Jev from @typesafeai at @chainloop_dev for security classification, and the results are better than I expected. The task is simple to explain. Go through the full commit history of a repo and ask one question per commit: was this a security fix? Then classify the vulnerability and give a confidence score. This is how we build the AI Security Context for every connected repo at Chainloop. Why is this useful? (more in our docs, linked in the comments) 1. Find regressions and first-party vulnerabilities with adversarial analysis. Your AI agents get this context when they write code, so they know where the codebase got burned before and can hunt for unpatched variants of old bugs. 2. Measure the security hygiene of a project over time. Every confirmed fix is dated and classified, so you get an honest record: how fast you patch, how long bugs stayed exposed, which classes keep coming back. 3. Audit evidence. That record holds up in audits and security reviews, and it is a good way to judge a codebase before you depend on it. DM me if you want to try it. ps. Policies are next. Most of our agentic policies are the same problem anyway: here is the evidence, here is the question, give me a verdict with a reason and a score.

A month of AI-driven audits against @chainloop_dev’s codebase found serious bugs that had passed review, tests, and CI. We fixed them and documented the experiment: bit.ly/3TcSEhh #AppSec #AISecurity

this is one of the reasons why cyber-security concerns around AI get it completely wrong human-slop code is full of so many security problems its mind blowing... most people have no idea just how bad it is the same LLMs that can be used to find them by bad guys can be used by vendors to patch them proactively and patch them before they're exploited

Changelog: AI Agent Governance, Ask Chainloop, and Supply Chain Hardening chainloop.dev/blog/changelog…

AI coding agents are writing your code. But who's governing them? We just shipped support for AI agent configuration and session evidence. Every instruction file, tool invocation, model used, every file changed, captured, signed, and policy-enforceable. chainloop.dev/blog/agentic-c…