Welcome to the JFrog Blog

Latest:

Don’t Break the Agent: Lessons in Token Optimization

August 20, 2026 Shay Dahan, JFrog Boost Co-Founder Yahav Ohana, JFrog Boost Co-Founder

9 min read

This one is for the curious souls who wonder how somebody actually builds a harness optimizer — and, more to the point, how they know it works. When we launched JFrog Boost into public preview, we told the story of the bill that broke us and the 100 billion tokens we clawed back across JFrog…

Read More

All Blogs

Frontier AI Application Security: Every Second Counts

Frontier AI Application Security: Every Second Counts

August 18, 2026 Matan Libis, JFrog Director of Product for Application Security | 8 min read

Somewhere in the last few months, the math of application security quietly broke. Anthropic's Claude Mythos Preview didn't just analyze code, it found a 27-year-old vulnerability in OpenBSD, a 16-year-old bug in FFmpeg, and a 17-year-old remote code execution flaw in FreeBSD, entirely on its own. Then it went further: it built working exploits for…
Read More
JFrog Artifactory Now Integrates Natively with Artifact Registry in Google Cloud

JFrog Artifactory Now Integrates Natively with Artifact Registry in Google Cloud

August 12, 2026 Eldad Assis, JFrog Principal DevOps Architect, CTO Office | 6 min read

Teams running containerized workloads on Google Cloud have long relied on JFrog as their single source of truth for container images. The missing piece has been getting Google Cloud's own runtime services — like Cloud Run and Google Kubernetes Engine (GKE) — to pull directly from JFrog for every container image pull. I’m happy to…
Read More
Fast Remediation Is the New Trust Model: JFrog and OpenAI Collaboration on Zero-Day Security Findings

Fast Remediation Is the New Trust Model: JFrog and OpenAI Collaboration on Zero-Day Security Findings

July 27, 2026 Yoav Landman, JFrog CTO | 5 min read

UPDATE August 5, 2026: This week at Black Hat USA, the OpenAI team presented a detailed reconstruction of the chain of events behind the Hugging Face incident. I was glad to watch OpenAI speaking openly about it. This kind of transparency reflects the same spirit of collaboration we experienced working with their team behind the…
Read More
The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results

The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results

July 21, 2026 Guy Korolevski, JFrog Security Researcher | 14 min read

The JFrog Security Research team has discovered and disclosed a typosquatted NuGet package named Newtonsoftt.Json.Net. Note the double t and the .Net suffix.  This package has been masquerading as the popular Newtonsoft.Json library while quietly shipping a trojanized fork. The trojan rigs Digitain, an online betting platform, and in later generations, exfiltrates rigged round results…
Read More
Secure AI Workflows: The Identity and Access Management (IAM) Checklist

Secure AI Workflows: The Identity and Access Management (IAM) Checklist

July 8, 2026 Mika Lanir, JFrog Technical Writer Sean Pratt, JFrog Director of Product Marketing | 6 min read

AI agents and LLMs are already building, analyzing, and deploying code across your software development lifecycle. As software supply chains become increasingly AI-driven, proactive security and access controls are your only path to success. To effectively govern authentication and permissions without sacrificing development speed, you must update your access management strategies. By securing the AI…
Read More
Beyond Tokens SF: Best Ideas of the Evening

Beyond Tokens SF: Best Ideas of the Evening

July 7, 2026 The JFrog Team | 5 min read

AI agents are changing how software gets built, but the infrastructure around them hasn't caught up. Agents burn through tokens on noise. They take actions they shouldn't. Context evaporates between releases. And most delivery pipelines were never designed for the pace and volume of agentic development. On June 11th we brought together developers in San…
Read More
Where Severity Scores Go Wrong: “Just Add Prototype Pollution”

Where Severity Scores Go Wrong: “Just Add Prototype Pollution”

July 1, 2026 Tamir Friedman, JFrog Security Researcher Ofri Ouzan, JFrog Security Researcher | 11 min read

At JFrog, our Security Research team continuously monitors and analyzes newly disclosed CVEs across the open-source ecosystem. Throughout our research, we have repeatedly observed cases where the assigned severity score does not accurately reflect a vulnerability's real-world impact or exploitability. In fact, during 2025, JFrog researchers reassessed NVD critical-severity vulnerabilities and concluded that 96% warranted…
Read More

Popular Tags