Chainloop

Governance infrastructure for the age of AI

[Chainloop @chainloop_dev]

We spent a month targetting AI security agents at our own code.

We are a security company. Composition analysis, vulnerability scanning and secret detection already in CI.

The agents found high-severity bugs anyway.

[Chainloop @chainloop_dev]

Observability of agents is one thing; extending and governing their behavior is another. Take a look at our current thinking on what session collection will look like in this write-up by our core engineer @javirln

https://t.co/91L4kI2DoT

[Miguel Martinez Trivino @migmartri]

Today we open-sourced our collector for AI coding sessions.

We built @chainloop_dev as the governance layer for an automated SDLC. Since then, the industry is quickly evolving to the agentic SDLC; the foundational premise is the same, but the scale and surface have changed.

[Daniel Liszka @danlishka]

Our engineers turned a codebase's own security-fix history into a map of where its next bug is likely to be. Worth reading if you run an AppSec program and your scanners only find known CVEs.

https://t.co/svxxCEfJTV

[Daniel Liszka @danlishka]

We are testing Jev from @typesafeai at @chainloop_dev for security classification, and the results are better than I expected.

The task is simple to explain. Go through the full commit history of a repo and ask one question per commit: was this a security fix? Then classify the vulnerability and give a confidence score. This is how we build the AI Security Context for every connected repo at Chainloop.

Why is this useful? (more in our docs, linked in the comments)

1. Find regressions and first-party vulnerabilities with adversarial analysis. Your AI agents get this context when they write code, so they know where the codebase got burned before and can hunt for unpatched variants of old bugs.

2. Measure the security hygiene of a project over time. Every confirmed fix is dated and classified, so you get an honest record: how fast you patch, how long bugs stayed exposed, which classes keep coming back.

3. Audit evidence. That record holds up in audits and security reviews, and it is a good way to judge a codebase before you depend on it.

DM me if you want to try it.

ps. Policies are next. Most of our agentic policies are the same problem anyway: here is the evidence, here is the question, give me a verdict with a reason and a score.

[Chainloop @chainloop_dev]

We ran this with great tools from our friends at @strix_ai and IronCurtain, on top of @AnthropicAI Claude Code, with proof-of-concept runs on @Kimi_Moonshot second opinions from @Zai_org GLM. @claudflare audit skill and @nvidia SkillSpector both earned their place.

[Chainloop @chainloop_dev]

We spent a month targetting AI security agents at our own code.

We are a security company. Composition analysis, vulnerability scanning and secret detection already in CI.

The agents found high-severity bugs anyway.

[Chainloop @chainloop_dev]

Methodology, tools, models, and what each one missed:

https://t.co/WifEUPsxnk

We ran this with some great tools from our friends at

[Chainloop @chainloop_dev]

And one run is not enough.

Our best single run found roughly half of what several runs found together.

Fan out parallel hunters. Fan in adversarial validators.

[Matías Insaurralde @mb_ins]

A month of AI-driven audits against @chainloop_dev’s codebase found serious bugs that had passed review, tests, and CI.

We fixed them and documented the experiment: https://t.co/4I74twlIlv

#AppSec #AISecurity

[dan ushman @danushman]

this is one of the reasons why cyber-security concerns around AI get it completely wrong

human-slop code is full of so many security problems its mind blowing... most people have no idea just how bad it is

the same LLMs that can be used to find them by bad guys can be used by vendors to patch them proactively and patch them before they're exploited

[Chainloop @chainloop_dev]

Learn more and grab a slot: https://t.co/F0ubZZB8T4

[Chainloop @chainloop_dev]

Meet the Chainloop founders @danlishka & @migmartri
at #BlackHat2026

Ask us for a demo! We will show you how we sandbox AI agents on-prem, govern AI coding sessions, and put vulnerability triage on autopilot: our AI agents assess the risk and open the fix PR, on your terms.

[Chainloop @chainloop_dev]

It works with Codex, Claude Code and Cursor, adding more soon!

[Chainloop @chainloop_dev]

If you are interested in what we are building re AI-Governance at Chainloop take a look at this article. AI adoption visibility through AI Coding Sessions and Session Alignment Scoring, enforcement through policies, compliance through controls.

https://t.co/TkRzbL9uWY

[Chainloop @chainloop_dev]

Changelog: AI Agent Governance, Ask Chainloop, and Supply Chain Hardening

https://t.co/N7BVEHrKId

[Chainloop @chainloop_dev]

AI coding agents are writing your code. But who's governing them?

We just shipped support for AI agent configuration and session evidence. Every instruction file, tool invocation, model used, every file changed, captured, signed, and policy-enforceable.

https://t.co/U8TiPRpg1L

[Miguel Martinez Trivino @migmartri]

Busy week for supply chain security. I know we're all busy building. But it's about time we stop for a moment and re-evaluate our security foundations. Supply chain security should be a first-class concern, not a post-mortem talking point.

https://t.co/eYeT49q6A0