company
Software supply chain security vendor whose agent checks changed dependencies for known vulnerabilities and package risk in a pull request comment.
No evidence-backed relationships are recorded.
A general resolution with eight options would turn "can we use AI here?" into project law. The exemptions matter more than the ban.
Reality
Endor Labs says a type confusion in isolated-vm's ExternalCopy turns a single ivm.Reference into host control-flow hijack. The remedy is a version bump to 7.0.1 or 6.2.0.
Reality
The poisoned keyv releases were signed by GitHub Actions and the attestation was accurate. It certified a build whose source had already been taken over.
Reality
The set runs from AI SAST to virtual patching. Harness has published no customer results, so the case rests on owning the pipeline rather than on detection quality.
Reality
The Linux Foundation's coalition for AI-generated vulnerability reports starts taking automated submissions next month. Its membership terms set the ceiling on what it can absorb.
Reality
GitHub's walkthrough has Amplitude, Endor Labs, LaunchDarkly and PagerDuty agents answering questions inside a single pull request. The integration point is now GitHub's agent harness.
Reality