AI in AppSec: What to Build vs. Buy | Endor Labs

Summary

Endor Labs argues that AI security agents built in-house often fail at scale, not in demos, because costs compound across repos and pull requests. In its research, an agent with precomputed evidence used about 6.6 million tokens over 133 minutes, versus 79.5 million tokens over 370 minutes for an unaided agent, across 34 AppSec prompts on 12 open-source projects.

Related items

• HighGHSA-46jr-4wx8-v453: MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationSame vendor · GitHub Advisory Database
• InfoBattle Drones - a vibe coded RTS with audio-based multiplayerSame vendor · Simon Willison's Weblog
• HighGHSA-22jm-h49p-29qw: MCP TypeScript SDK: Experimental tasks were not tied to the session that created themSame vendor · GitHub Advisory Database
• MediumGHSA-6prh-2h8m-c8cw: MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodiesSame vendor · GitHub Advisory Database
• InfoAnthropic in talks with neocloud Nscale over second multibillion-dollar deal, source tells CNBCSame vendor · CNBC Technology