Chainguard

Seattle – October 14, 2026 -- Chainguard has launched Chainguard Checks in Beta, a continuous verification engine that returns signed, trusted test results to developers and AI agents in seconds, before code reaches a pull request.

The product targets a bottleneck created by agentic development. Traditional CI was built for developers who push code a few times a day, while agents iterate constantly. Every change lands in the same queue, and results often return after the agent has lost its working context. Teams also pay repeatedly for the same setup work.

Chainguard Checks suspends agent sessions during test runs to halt compute use

Chainguard Checks works with the newly launched Chainguard Workspaces. An agent session suspends while checks execute, which stops compute consumption. It then resumes in seconds, with structured failure logs injected directly into its context so it can iterate until tests pass.

Seattle – October 14, 2026 -- Chainguard has launched Chainguard Harness, a cyber harness that runs frontier AI models such as Anthropic's Claude Mythos 5.1 against a live build of a customer's application and delivers only reproduced vulnerabilities, each paired with an engineer-reviewed fix. The product is available through the Claude Marketplace by Anthropic, so enterprises can buy it with their existing Anthropic commitment.

Harness tests running applications in isolated microVMs instead of scanning static code

Harness connects to a team's repository through the Guardener GitHub app, builds the application as it ships, and boots it in an isolated microVM. A frontier model then probes the running instance the way an attacker would. Chainguard says this approach surfaces logic flaws, injection paths and resource exhaustion bugs that appear only at runtime and that traditional static scanners miss.

Kirkland, Wash. – October 14, 2026 -- Seventy-seven percent of security leaders expect an attacker to exploit a software vulnerability at their organization within 12 months, while 54% admit their companies knowingly leave high or critical vulnerabilities unpatched at least sometimes, according to a Chainguard report surveying 1,300 security leaders.

The report, titled The AI Exploit Gap, measures the distance between how fast AI-powered tools can find and chain vulnerabilities and how fast human teams can fix them. Ninety-one percent of respondents say AI-accelerated attacks have changed their job more than anything else in the past decade. Ninety-three percent worry their companies cannot remediate AI-driven exploits quickly enough.

Seattle – October 14, 2026 -- Chainguard has launched Chainguard Workspaces in Beta, giving every developer and coding agent its own hardened microVM with no access to sensitive credentials and optional egress policies that block any connection a team has not approved.

Chainguard moves agent protection from the agent to its environment

The company argues that most coding agents today hold the same access as the developer who launched them, sitting next to credentials, cloud keys and production systems. Controls such as permission prompts and allowlists depend on the agent following the rules. Many developers now run a dozen agents or more at once, forcing teams to choose between granting broad access and approving prompts all day.

Chainguard CEO and Co-founder Dan Lorenc said teams are choosing between letting agents run next to production keys and babysitting them, and that "neither one scales."

Seattle – October 14, 2026 -- Chainguard has extended its Libraries product to Go and .NET, added CVE remediation for JavaScript and Go, and begun delivering fixes for zero-day vulnerabilities on the day they are made public.

Chainguard Libraries for Go and .NET are available in Early Access. They give engineering teams and AI agents a managed endpoint for pulling dependencies without exposure to malicious packages.

Chainguard cites 76% AI-attack exposure among security leaders

Chainguard's AI Exploit Gap report found that 76% of cybersecurity leaders say their organization has experienced, or suspects it has experienced, an AI-driven attack in the last 12 months. Attackers publish malicious packages, hijack trusted ones, and register names of packages that do not yet exist, counting on developers and AI agents to install them unchecked. AI also lets anyone build and publish malicious packages or exploit CVEs and fresh zero-days.

New York – September 23, 2026 -- Chainguard has been authorized by the CVE Program as a CVE Numbering Authority (CNA), granting it the power to assign official vulnerability identifiers for qualifying open source flaws surfaced through its Athena coalition.

Chainguard gains authority to assign CVE identifiers for unclaimed open source flaws

The CNA scope covers cases where upstream maintainers have already fixed a flaw without issuing an identifier, where no maintainer remains to assign one, or where no more specific CNA covers the affected project. Chainguard's CVE Records will defer to maintainers and project-specific CNAs wherever they exist.