Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

TL;DR: Aikido now pentests Android apps. The same agents that test your web apps and APIs can now work through your APK, log into the app, and reason through it, alongside the backend it talks to, in a single assessment. Findings come back with reproduction steps and are ready for an AutoFix, the same as any other Aikido pentest. Aikido has been running autonomous pentests against web apps and APIs since November 2025.

Aikido Security has achieved ISO 42001:2023 certification, the international standard for AI management systems, a step few security vendors have taken so far. The certification confirms that Aikido runs a structured, continuously improving governance system for managing the risks introduced by its AI-enabled features, across our entire platform.

Claude Mythos is arguably the strongest cybersecurity model that Anthropic has built. But we know that model capability is only part of what determines how well an AI vulnerability product performs. To test that, we put Anthropic’s Claude Security, which runs on Mythos, and Aikido Code Security Audit head-to-head on the exact same target to see which harness can deliver the best coverage and at what cost. Code Security Audit is part of Aikido’s AI Code Analysis suite.

npm launched Package Provenance in late 2022. For two years, adoption averaged 20-50 packages per week. Followed by Trusted Publishing in 2024. Blog posts were written. CISA advisories were issued. The line barely moved. Eventually Trusted Publishing with OIDC was made Generally Available in July 2025 Then Shai-Hulud hit. Weekly adoption jumped to 430 packages. In 18 months, cumulative adoption grew 3.4x.

On August 20, we detected two popular Rust crates from the same maintainer, append-only-vec (4M downloads) and arrayref (244M downloads), were compromised. The attacker added a malicious dependency on a package called proc-macro1, which downloads a remote payload during the build and executes it on the developer's machine.

Gogs is an open-source Git hosting platform like GitHub or GitLab. The application allows users to manage their own repositories and organizations. Under the hood, it relies heavily on the git CLI.

Harness engineering is the practice of building the layer, including code, that turns an AI model from a text generator into an agent that can take actions. In short, an AI agent is a model plus a harness. The model decides what to do next, and the harness makes it happen, connecting the model to tools, context, external systems, and validation. In a lot of practical work, and especially in security work, the harness decides the quality of the output more than the choice of model does.

The fever dream continues, and I'm not even in Vegas for Hacker Summer Camp. Last week I wrote about Anthropic disclosing that one of their models published live malware to PyPI while believing it was inside a simulation. I was running a fever when I read the report. The metaphor was too good: a model that couldn't tell simulation from reality, covered by a writer who wasn't sure which way was up. I thought that was a one-week story. Very naive of me to have so much faith, I know.