JFrog immunizes what agents consume and controls how they build and deploy — every AI model, agent skill, plugin, MCP server, package, and AI-generated artifact, governed in a single source of truth.
Run with a trusted agentic workforce.
The universal and adaptable JFrog Platform solves essential cross-industry agentic software supply chain challenges.
Accelerate software delivery while meeting strict regulatory standards like HIPAA and FedRAMP
Build a continuous audit trail for CRA, DORA, NIST SSDF, and CERT-In compliance.
Recent events have once again highlighted the need to quickly answer the question, “Are we exposed?” We now face threats to businesses and governments from vulnerabilities and compromises in three fundamental components used in software development: Curl, PHP, and LiteLLM. Curl When it comes to Curl and its underlying transfer library libcurl, the threat can …
Integrating artificial intelligence into cybersecurity has fundamentally changed vulnerability research – and not necessarily for the better. For decades, discovering and verifying Common Vulnerabilities and Exposures (CVEs) required deep technical expertise, creating a disciplined process that kept disclosure volume relatively manageable. Today, Generative AI has obliterated that barrier to entry. While AI empowers seasoned security …
The way software gets built has changed faster than the standards that govern it. AI agents now create pull requests, select dependencies, refactor codebases, interpret test failures, and execute infrastructure changes across the entire Software Development Life Cycle (SDLC). AI agents are autonomous team members, but unlike human engineers, they are ephemeral: their reasoning, decisions, …
For twenty years, the software security playbook has worked the same way. You find the vulnerability, score it, open a ticket, assign it to a human, wait for the fix, ship the patch, and prove it happened. Every step in that sequence assumes humans can review each fix individually and still keep up. Frontier AI …
Most organizations spent years hardening their software supply chain. The model is familiar: dependencies flow through a controlled repository, policies determine what is allowed, scanning catches what slips through, and every action is logged for auditability. It works because human developers operate within environments that enforce these rules. AI coding agents break that assumption entirely. …
Malicious packages and AI assets have grown 7.4x in the last three years. And yet, four out of five enterprises have no governance framework for coding agents. The software supply chain has become agentic, yet most enterprises are still securing and governing it with the manual systems from the last era. This moment requires a …
Notice: JFrog AI Catalog is now JFrog AI Security. AI registries have moved to Artifactory, while AI asset curation is now managed in Curation. Learn more. Ask most security tools what an AI coding agent just built, and they can tell you. Ask what it was allowed to consume before it started, and far fewer …
UPDATE August 5, 2026: This week at Black Hat USA, the OpenAI team presented a detailed reconstruction of the chain of events behind the Hugging Face incident. I was glad to watch OpenAI speaking openly about it. This kind of transparency reflects the same spirit of collaboration we experienced working with their team behind the …
The JFrog Security Research team has discovered and disclosed a typosquatted NuGet package named Newtonsoftt.Json.Net. Note the double t and the .Net suffix. This package has been masquerading as the popular Newtonsoft.Json library while quietly shipping a trojanized fork. The trojan rigs Digitain, an online betting platform, and in later generations, exfiltrates rigged round results …
AI agents are changing how software gets built, but the infrastructure around them hasn’t caught up. Agents burn through tokens on noise. They take actions they shouldn’t. Context evaporates between releases. And most delivery pipelines were never designed for the pace and volume of agentic development. On June 11th we brought together developers in San …
Claude 
Cursor 
Codex 
Hugging Face 
NVIDIA 
Visual Studio Code 
Devin 
Kiro 
Open Code 
NanoClaw 
Docker 
npm 
PyPy 
Wiz 
Financial Services 
Gaming 
Public Sector 
Automotive 
Technology 
Healthcare 
