TAG
#devsecops
Stories connected through a shared idea, actor, technology or theme.
JFrog adds AgentSecOps controls across the agentic software supply chainJFrog announced a suite connecting models, MCP servers, skills, plugins, prompts and other AI assets to its software-supply-chain platform. It includes semantic scanning, an agent-plugin registry, APM package management, project-scoped Agent Guard policies and network-layer routing through Artifactory.→Cycode releases agentic code scanning and attack-path chainingCycode said its Agentic Code Scanning combines rule-based and agentic analysis, while its benchmark testing found two authorisation CVEs that rule engines could not express. Its new Attack Chaining capability links related findings into multi-step exploit paths.→AI-Infra-Guard 4.6 adds LLM API-poisoning checks and agent red-team coverageAI-Infra-Guard 4.6 adds an API Checker security-audit module with web-proxy integration, a detector for LLM API poisoning, a v5 Agent-Scan mutation-engine refactor and a DeepSeek Harness prompt-injection assessment. It also tightens YAML rule validation, migrates MCP clients to SDK 2.0 and fixes parser, filename and JSON-serialisation failure modes.→TRACE proposes a portable evidence standard for AI-agent runtimesOPAQUE said TRACE was developed with AMD, Intel, Microsoft and the Technology Innovation Institute and contributed to the Linux Foundation. The specification combines attestation, provenance and workload-identity standards to record software, policies, data classifications and tools used by an AI workload.→Nucleus Helix combines vulnerability intelligence with agentic exposure workflowsNucleus said Helix adds passive early-warning discovery before scanner signatures are available, a natural-language AI agent and expanded data-collection and remediation guidance. The platform is grounded in Nucleus's asset, software, ownership and exposure data.→EPAM and Wiz pair cloud-risk findings with engineering-led remediationEPAM said it will use Wiz's Security Graph and AI-APP across code, cloud, runtime, AI applications, SaaS and custom-hosted environments. The partnership adds EPAM engineering and White Hat offensive-security capabilities to help validate and remediate exploitable paths.→