Endor Labs + SpaceXAI: Securing every stage of agentic software delivery. Endor Labs and SpaceXAI are partnering to secure every stage of agentic software delivery on Grok Build, from the first tool call to merged pull requests. Published on October 5, 2026 Updated on October 5, 2026 Summarize with AI AI coding agents now write a large share of production code. Across 22,000 developers, the Faros AI Engineering Report 2026 found the share of AI-generated code accepted into codebases rose from 20% to 60%. More code also means more dependencies and more attack surface. The same Faros report found bugs per developer up 54% as AI adoption scales. The stakes are highest for enterprises in regulated industries - banks, insurers, healthcare providers - where enterprise security controls aren't optional. Legacy security tooling wasn't built for this. It was designed to act as a gate at the end of the pipeline, where it slows builds and adds delays. That model breaks when agents ship code all day. That's why Endor Labs works with SpaceXAI to secure every stage of the agentic software development lifecycle on Grok Build. Endor Labs checks code and dependencies as the agent produces them, and fixes issues before they leave the session. Why this partnership matters now. SpaceXAI's mission is to accelerate human scientific discovery, building AI that extends what people can achieve. For software teams, that work shows up in Grok Build, SpaceXAI's platform for end-to-end software development lifecycle support. On Grok Build, agents plan work, write code, pull in dependencies, and run tasks across the lifecycle. When agents handle that much of delivery, every line they generate needs to be governable, traceable, and defensible. That bar is highest for regulated enterprises that want agentic development at scale. Endor Labs and SpaceXAI share a design principle: the best security is something developers never have to think about. Grok Build makes agentic development feel effortless. Endor Labs keeps the guardrails that enforce your policies just as invisible. AURI by Endor Labs is the security harness for agentic coding. It gives security teams visibility into agent activity, enforces policy as code, helps agents generate secure code by default, and blocks vulnerable and malicious dependencies before they reach your codebase. Security leaders get audit-ready evidence they can defend to the board, even as code volume keeps climbing. Building a collaboration. The team behind Grok Build (formerly Cursor) chose Endor Labs to secure its own codebase before Endor Labs started building together. Their security team needed to separate real vulnerabilities from noise. "Over 97% of vulnerabilities flagged by our previous tool weren't reachable in our application. AURI by Endor Labs shows the few impactful vulnerabilities, so we can patch quickly, focusing on what matters." Travis McPeak, Security, SpaceXAI That customer relationship became the foundation for the integration. Endor Labs started with a free MCP server that checks for code security risks, exposed secrets, and vulnerable dependencies. In December 2025, Endor Labs added a hooks integration that scans every package an agent installs. In May 2026, Endor Labs added Coding Agent Governance, and in June Endor Labs added the Endor Labs Agent Kit that brings specialized remediation agents directly into Grok Build. How it works. Grok Build does the work of software development. Endor Labs secures each step, so security issues are found, triaged, and fixed inside the session instead of piling up after it ends. From inside the same session, you can ask Endor Labs to check that everything the agent touched is secure. This includes: * The AI tools you use. With Endor Labs Coding Agent Governance, hooks record every MCP tool call, shell command, and file operation, and enforce your policies before each action runs. Hooks are deterministic, so enforcement never depends on a model's judgment. Security teams see which agents, MCP servers, models, and skills developers use, and can block the ones they haven't approved. Endor Scores rate each MCP server and skill for trust, mapped to the OWASP Top 10 for LLM Applications. * The code you write. Endor Labs AI SAST scans first-party code for security flaws and traces the data flow that shows how untrusted input reaches a vulnerable call. Exposed secrets get flagged before they are committed. * The dependencies you pull in. Endor Labs SCA checks direct and transitive dependencies against vulnerability data from public and proprietary sources. Reachability analysis and risk scoring show which vulnerable dependencies your application actually calls, cutting SCA findings by up to 92%. Coding Agent Governance hooks also block confirmed malicious packages at install time, and teams that route installs through Endor Labs Package Firewall get the same protection at the registry level. Fix what it finds. Finding a flaw is half the job. The AURI agents in the Endor Labs Agent Kit are specialized security agents that pull findings, context, and remediation data from Endor Labs scans and prioritize what to fix first. The Endor Labs AI SAST Remediation agent, for example, works with Grok Build to propose a fix for the most critical code flaws, along with a test plan. Once the developer approves, Grok Build applies the patch and runs the tests. With approval, the agent can also open a pull request for the fix. The SCA Remediation agent can do the same for dependencies. It queries the scan results, checks how each package is used in the project, and weighs the Endor Labs evidence. Grok Build applies the upgrade, adds tests, catches the break, and writes a workaround. It then rescans with Endor Labs to confirm the fix and check that no new vulnerabilities came in. Depending on what is safest, a fix can be a package upgrade, a code change, or an Endor Patch. What you get. Every change the remediation agents make sits behind its own approval gate, so developers decide what lands. Code leaves a Grok Build session scanned, fixed, tested, and rescanned, with the evidence behind each fix. The same Agent Kit workflows can also run outside the IDE, in CI or cloud runs, through the Grok Build SDK. Get started. Install the Endor Labs Agent Kit for Grok Build from the marketplace (or type /add-plugin endorlabs in the agent chat), then ask Grok Build to scan your project. The kit walks you through setup. Enterprise teams can book a demo to see how Endor Labs and Grok Build secure agentic software development end to end. What's next? When you're ready to take the next step in securing your software supply chain, here are 3 ways Endor Labs can help:

Endor Labs recognized by Gartner(R) in the 2026 Hype Cycle(TM) for Application Security. Endor Labs was named in the 2026 Gartner(R) Hype Cycle(TM) for Application Security across three categories: Agentic Application Security Testing, Software Supply Chain Security, and Reachability Analysis. Andrew Stiefel Published on July 23, 2026 Updated on July 30, 2026 Summarize with AI Endor Labs has been named a Sample Vendor in the Gartner(R) Hype Cycle(TM) for Application Security, 2026 across three categories: * Agentic Application Security Testing * Software Supply Chain Security * Reachability Analysis Endor Labs see recognition across all three as validation of a thesis Endor Labs has held since founding the company: application security in the agentic era is one connected problem, not three separate product categories. The code agents write, the open source they pull in, the way teams prioritize and fix what they find, and how you secure the systems producing code all depend on the same thing: a deep, continuously updated understanding of how your applications behave. Agentic coding changed the problem. Software engineers now ship code with AI agents in the loop by default. Pull request volume is up 113%, yet its agent code security benchmark shows that 70% or more of AI-generated is insecure. Agents also make dependency decisions on their own, importing packages no human vetted, at a moment when attackers are poisoning open source ecosystems specifically to target agentic workflows. This shift breaks the scan-after-build model. When agents plan, write, test, and open PRs with minimal human checkpoints, security has to work the way agents work: embedded in the development loop, evaluating code as it's produced, checking dependencies as they're chosen, and fixing issues before they merge. Securing agentic coding means securing the code agents produce and the software supply chain they draw from, together. That is the story Endor Labs read across its three recognitions in this year's Hype Cycle. Securing the code agents produce. Traditional SAST pattern-matches against known signatures, which is why legacy tools miss business logic flaws and drown teams in false positives. Agentic application security testing takes a different approach, using LLMs and reasoning to analyze application logic the way a security researcher would. Endor Labs built AI SAST on the belief that reasoning alone isn't enough. Pure LLM approaches lack the deterministic grounding that mature security programs require, so AURI by Endor Labs combines LLM-based reasoning with program analysis trained on ground-truth vulnerability data. Every finding is anchored to its code context graph, a continuously updated model of application behavior across code, dependencies, secrets, and containers. The results show up in its AI SAST benchmark against traditional scanners and frontier models across eight real projects. Endor Labs AI SAST found 192 real vulnerabilities, 2.6x more than Claude Code and 3.5x more than OpenAI Codex, and surfaced 63 vulnerabilities no other tool in the test caught. Those unique findings were concentrated exactly where agentic testing earns its keep: broken access control, authentication failures, and business-logic flaws that depend on how an application behaves rather than what a pattern matches. Securing coding agents and the software factory itself. Most applications are mostly other people's code, and AI agents have made third-party consumption faster and less supervised. An agent that hallucinates a package name or picks an unmaintained dependency expands your attack surface in seconds. This recognition adds to Gartner's view of Endor Labs in the category: Endor Labs were also named a Visionary in the 2026 Gartner(R) Magic Quadrant(TM) for Software Supply Chain Security, which Endor Labs see as recognition of both where the market is heading and how Endor Labs is building for it. Endor Labs secures the supply chain at the point of consumption. Package Firewall scans newly published packages across npm, PyPI, and other ecosystems and flags emerging malware campaigns in under 10 minutes, blocking both developers and coding agents from pulling malicious packages into a local machine or CI runner. AI Coding Agent Governance extends that visibility to the agents themselves: which models, MCP servers, and tools are active in your development environment, and whether their behavior matches your policies. SBOM generation, artifact signing, and CI/CD posture management round out coverage from dependency selection through delivery. Reachability analysis: fixing what matters. Finding more issues only helps if teams can act on them. Function-level reachability has been core to Endor Labs from day one: Endor Labs analyze call graphs across first-party code, direct and transitive dependencies, and container layers to determine whether your application can actually invoke a vulnerable function. On average, that lets teams deprioritize 92% of vulnerability noise and focus engineering time on exploitable risk. Reachability also powers remediation. Upgrade impact analysis shows exactly which breaking changes a patch will trigger before anyone touches a version number, and Endor Patches fix vulnerabilities in hard-to-upgrade libraries without forcing a major version bump. The result is 6x faster remediation, because fixes ship as predictable engineering tasks instead of blind upgrades. One platform for agentic coding security. These three capabilities share a single foundation. The code context graph gives coding agents the context to write secure code by default, gives PR reviews the evidence to separate real risk from noise, and gives remediation the confidence to fix without breaking builds. Testing informs prioritization. Supply chain intelligence informs what agents are allowed to do. Reachability informs everything. Endor Labs think that connected architecture is what application security looks like when agents write most of the code, and Endor Labs is glad to see the categories it spans recognized in this year's Hype Cycle. Want to see how AURI secures agentic development end to end? Request a demo. Disclaimer Gartner, Hype Cycle for Application Security, 2026, Dionisio Zumerle, 21 July 2026. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, and HYPE CYCLE is a registered trademark of Gartner, Inc. and/or its affiliates and are used herein with permission. All rights reserved. What's next? When you're ready to take the next step in securing your software supply chain, here are 3 ways Endor Labs can help:

This week in Open Source for july 16, 2026. Thursday, july 16, 2026. by Daryl Ducharme, Open Source Programs Office A look around the world of open source open source is diving into another week of open source news and discussions. As the ecosystem continues to evolve, open source is seeing more conversations around the intersection of AI workflows, security at scale, and the infrastructure that supports the open web. This week, open source is highlighting a few "Open Source Reads" that tackle some of the biggest questions facing its ecosystem today - from the complex ethics of AI-generated workflows to the future of federated social networks. open source hope these links provide valuable context as open source work together to sustain the critical infrastructure open source all rely on. * ASWF Open Source Days (July 19-20) - Los Angeles, CA. Hosted by the Academy Software Foundation, focusing on open source software in visual effects (VFX) and animation. * KubeCon + CloudNativeCon Japan 2026 (July 28-30) - Yokohama, Japan. The Cloud Native Computing Foundation's flagship conference in Japan. * Black Hat & DEF CON 2026 (August 1-9) - Las Vegas, NV. While primarily cybersecurity, both heavily feature open source hacking tools. The Open Source Security Foundation (OpenSSF) also has a major presence here. * FOSSY (August 6-9) - Vancouver, Canada. A highly community-focused open source conference emphasizing grassroots participation and collaboration. * Community over Code Asia (August 7-9) - Beijing, China. The Asian edition of the Apache Software Foundation's (ASF) community-first conference. * Open Source Summit Korea (August 11-12) - Seoul, South Korea. Hosted by the Linux Foundation, bringing together open source maintainers and enterprises. * KubeCon + CloudNativeCon + OpenInfra Summit + PyTorch Conference China (September 7-9) - Shanghai, China. A massive collaborative mega-event uniting open infrastructure, cloud, and AI communities. * OSPOlogy + OSPO Summit (September 7) - Shanghai, China. Focused on Open Source Program Offices (OSPOs), governance, and corporate open source sustainability. Open Source Reads and links. * [Blog] Elephants, Goldfish and the New Golden Age of Software Engineering - This isn't directly open source, but with the open source ecosystem trying to find good AI workflows I thought the Elephant-Goldfish model was an interesting take. It makes the distinction between using AI as a toy and using it as a tool. * [Article] Open-source AI and the Choice Before Us - The communities with minimal influence on AI development will likely be the most affected by it. This article looks at how strong rules and institutions are needed to guide AI's safe and fair use. The future of AI depends on whether open source build systems that include everyone or just deepen existing divides. * [Article] Open source carries the world. Patching it at Mythos-scale can't fall to maintainers alone. - The past year has shown that AI is speeding up the discovery of vulnerabilities in open source software. Endor Labs is offering a solution to utilize AI to create patching stop gaps for users of the libraries so that maintainers and contributors have the time to create good quality fixes to these vulnerabilities. * [Blog] The AT-URI Syntax Mess - I am very excited about the open social web, especially things happening around the AT protocol. Early misunderstanding led to the current AT URI syntax being invalid. This article looks at the possible ways forward. * [Article] The Open Social Web Needs Section 230 to Survive - The open web has always been a promise of free speech. When walled garden social media got involved it created some questions around whether free speech applies to the content served by the corporations running those networks. However, the open social web is not run by corporations. It can be, and it can also be run by individuals federating instances or running their own PDS. So, how do open source maintain the free speech promise of the internet with this in mind? Which of these stories will you be chatting about at your next meetup or conference? Let open source know! Share with open source on its @GoogleOSS X account or its @opensource.google Bluesky account.