Welcome to the JFrog Blog

Latest:

The Secret Sauce of SLSA: DevGovOps at the Speed of Agentic AI

August 5, 2026 Paul Davis, Field CISO

8 min read

Software supply chain engineering has reached a critical inflection point. As autonomous AI coding agents transition from generating autocomplete suggestions to planning, writing, reviewing, and deploying entire software pipelines without humans in the loop, the connection between human intent and production binaries is fracturing. This shift has created a severe structural deficit across enterprise tech…

Read More

All Blogs

Fast Remediation Is the New Trust Model: JFrog and OpenAI Collaboration on Zero-Day Security Findings

Fast Remediation Is the New Trust Model: JFrog and OpenAI Collaboration on Zero-Day Security Findings

July 27, 2026 Yoav Landman, JFrog CTO | 4 min read

Just last week, OpenAI and Hugging Face jointly disclosed what may be the first incident of its kind: during an internal evaluation of frontier cyber capabilities, OpenAI's models, running deliberately without production safeguards in an isolated research environment, autonomously discovered and employed chained vulnerabilities to escape its sandbox, reach the open internet, and extract evaluation…
Read More
Why Model Routing Backfires and How to Build Agents That Don’t Burn Your Budget

Why Model Routing Backfires and How to Build Agents That Don’t Burn Your Budget

July 23, 2026 Shay Dahan, JFrog Boost Co-Founder Yahav Ohana, JFrog Boost Co-Founder | 8 min read

Model routing promises to cut your AI agent spend by offloading routine tasks to cheaper models like Claude Haiku while reserving frontier models like Claude Sonnet for complex reasoning. In the right configuration, routing strategies can reduce inference costs by 40–85%. But if you implement routing incorrectly in a multi-turn agent, you can end up…
Read More
The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results

The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results

July 21, 2026 Guy Korolevski, JFrog Security Researcher | 14 min read

The JFrog Security Research team has discovered and disclosed a typosquatted NuGet package named Newtonsoftt.Json.Net. Note the double t and the .Net suffix.  This package has been masquerading as the popular Newtonsoft.Json library while quietly shipping a trojanized fork. The trojan rigs Digitain, an online betting platform, and in later generations, exfiltrates rigged round results…
Read More
Governance at the Speed of AI: How DevGovOps Closes the DORA Compliance Gap

Governance at the Speed of AI: How DevGovOps Closes the DORA Compliance Gap

July 19, 2026 Nir Peleg, JFrog Global Field CISO Sophie Starchenko, Senior Product Manager, JFrog AppTrust | 10 min read

What is DevGovOps? DevGovOps is a Software Supply Chain Engineering practice that integrates continuous governance and compliance into the DevOps software delivery lifecycle. Rather than treating compliance as a retrospective, manual hurdle, DevGovOps ensures that policy enforcement, continuous auditability, and cryptographic traceability are natural outputs of every release. By shifting from point-in-time checks to continuous…
Read More
Managing AI Agent Primitives Like Real Software Packages with APM and JFrog

Managing AI Agent Primitives Like Real Software Packages with APM and JFrog

July 14, 2026 Yonatan Arbel, JFrog Developer Advocacy Lead Daniel Meppiel, Creator of APM, Software Global Black Belt, Microsoft | 13 min read

AI agents are part of the modern development workflow. They write code, review pull requests, generate tests, call tools, interact with MCP servers, and help developers move faster. But behind every useful agent, there is something just as important as the model itself: the context that tells the agent how to behave. That context can…
Read More
Boost Is Now In Public Preview

Boost Is Now In Public Preview

July 9, 2026 Yahav Ohana & Shay Dahan, Co-Founders of Boost at JFrog | 7 min read

Today, we're excited to announce that Boost is moving out of beta and into public preview. After months of building, breaking, and rebuilding inside JFrog's own R&D organization, Boost is ready for the world. If you are currently running into token limits, unpredictable costs, or runaway usage from AI agents, Boost was built for you.…
Read More
Secure AI Workflows: The Identity and Access Management (IAM) Checklist

Secure AI Workflows: The Identity and Access Management (IAM) Checklist

July 8, 2026 Mika Lanir, JFrog Technical Writer Sean Pratt, JFrog Director of Product Marketing | 6 min read

AI agents and LLMs are already building, analyzing, and deploying code across your software development lifecycle. As software supply chains become increasingly AI-driven, proactive security and access controls are your only path to success. To effectively govern authentication and permissions without sacrificing development speed, you must update your access management strategies. By securing the AI…
Read More

Popular Tags