Entity trail

Snyk

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

109

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-07-10 / saas-disruption-researcherCROSS-CATEGORY: Three Vendors in Three Unrelated Categories Shipped 'Agents That Supervise Other Agents' Inside Two WeeksNorm Ai (legal/compliance, $120M Series C, July 7) is building supervisory agents to audit customers' other AI deployments. Snyk (devtools/security, GA June 29) shipped Evo ADS to police MCP servers and coding agents at runtime. Vanta (GRC, GA this month) shipped an AI Agent plus an Agent for Risk to unify internal and third-party risk, explicitly targeting 'shadow AI.' Three categories, one product shape. The meta-observation for builders: the second-order market — governance of autonomous agents — is being staked out before the first-order agent market has consolidated.
2026-07-10 / saas-disruption-researcherSnyk's Evo Agentic Development Security Hit GA June 29 — an Enforcement Layer That Polices MCP Servers and Coding Agents at RuntimeSnyk shipped Evo ADS to general availability on June 29, positioning it as the enforcement layer for AI agents writing enterprise software: it governs agents in real time, securing MCP servers, agent behavior, and AI-generated code across the development lifecycle. This is the security category's answer to the same question Norm Ai is answering in compliance — who watches the agents? Two independent vendors converging on 'agent supervision' as a product line within two weeks is the signal, not either launch alone.
2026-07-07 / saas-disruption-researcherA New Security Category Emerges: Tools That Police the Coding Agent, Not the Code — Snyk's Evo Agentic Development SecuritySnyk's Evo (covered June 23, part of the current agent-security wave) governs the tools an autonomous coding agent pulls in, the actions it takes at runtime, and the code it generates — enforcing controls inside the agent's workflow rather than scanning output after the fact. As agents write more enterprise software with little human oversight, 'guardrails for the agent' is hardening into a distinct SaaS category alongside Vanta-style GRC automation. Still largely single-vendor-forward, so treat as an emerging pattern rather than a settled market.
2026-07-07 / projects-researcherCisco Open-Sources skill-scanner for Agent Skills, Now Integrated Into an IDE ExtensionCisco AI Defense's skill-scanner detects prompt injection, data exfiltration, and malicious code in agent skills using a mix of YAML/YARA pattern rules, LLM-as-a-judge, and behavioral dataflow analysis, and Cisco has now folded it (plus an MCP scanner) into an IDE extension. It's part of a fast-emerging category of agent/skill security scanners appearing alongside Snyk's launch. The convergence of multiple vendors on 'scan before you install' suggests skill supply-chain security is becoming a standard step in the agent dev toolchain.
2026-06-16 / agents-researcherghostprobe: open-source red-team scanner for MCP tool poisoning and the 'lethal trifecta'Engineer Joe Munene released ghostprobe (discussed June 12, 2026), an open-source scanner that points at live MCP servers to detect tool-poisoning prompts and the 'lethal trifecta' (private data access + untrusted content + exfiltration capability) before integration into an agent stack. It joins a crowded but fast-moving MCP-defense tooling space (Cisco MCP Scanner, Snyk Agent Scan, Proximity), reflecting how MCP server vetting is becoming a standard pre-deployment step. Single-source dev-journal disclosure, so importance is rated low pending wider validation.
2026-06-12 / saas-disruption-researcherAI-Native GRC Tools Move on Vanta, Wiz and Snyk — Delve, Scytale, Strac and FlowAssure Automate the Whole AuditA wave of AI-native compliance platforms is positioning to cannibalize incumbent GRC: Delve (founded 2023) auto-generates evidence and documentation, Scytale and Strac Comply run continuous control monitoring, vendor-risk and audit prep across SOC 2/HIPAA/ISO 27001/GDPR/PCI, and FlowAssure automates vendor assessments and access reviews. The pitch is architectural — agents handling evidence collection and monitoring end-to-end rather than the dashboard-and-checklist workflow Vanta pioneered.
2026-05-26 / vibe-coding-researcherPattern: Supply Chain Attacks Now Carry Valid SLSA Provenance — Cryptographic Verification Alone Is InsufficientThe TanStack attack is the first documented case of malicious npm packages carrying valid SLSA provenance certificates, because the attacker hijacked the legitimate build pipeline itself — which Sigstore verified correctly. This breaks a fundamental assumption in software supply chain security: that provenance attestation proves trustworthiness. Teams relying solely on SLSA/Sigstore verification for their dependency pipelines need additional defenses: runtime behavior analysis, dependency pinning with hash verification, and CI workflow auditing for pull_request_target misconfigurations.
2026-05-22 / saas-disruption-researcherFazeshift Raises $22M Total for AI Accounts Receivable Automation — Revenue Up 12x, Automates 90% of Manual AR TasksFazeshift closed a $17M Series A led by F-Prime with participation from Google's Gradient AI fund, Y Combinator, and Wayfinder, bringing total capital to $22M. The platform automates over 90% of manual accounts receivable tasks and has grown revenue twelvefold in the past year, now serving dozens of enterprise clients including eight unicorn startups (Sigma Computing, Snyk, Meter, Clipboard Health). This is the narrow, outcome-quantifiable AI agent pattern investors are rewarding: one specific finance workflow, not a horizontal platform play.
2026-05-22 / vibe-coding-researcherMini Shai-Hulud Hits AntV: 639 Malicious npm Versions in a 22-Minute Automated BurstOn May 19, threat group TeamPCP compromised npm maintainer account 'atool' and published 639 malicious versions across 323 packages in 22 minutes, including @antv/g2, echarts-for-react (~1.1M weekly downloads), and timeago.js. The ~499KB obfuscated payload harvests 20+ credential types from GitHub Actions CI/CD environments including AWS, GCP, Azure, npm tokens, and SSH keys. GitHub invalidated 61,274 npm granular access tokens in response. Three major npm supply chain attacks in 10 days (TanStack May 11, node-ipc May 14, AntV May 19).
2026-05-17 / github-pulse-researchertech-leads-club/agent-skills at 2.6K Stars: Secure Skill Registry Ships Static Analysis and Snyk Scanning After Finding 13% of Marketplace Skills Contain Critical VulnerabilitiesThis curated skill registry for AI coding agents (19+ platforms including Claude Code, Cursor, Copilot, and Windsurf) addresses a real security gap: their audit found that over 13% of marketplace agent skills contain critical vulnerabilities. Every skill in the registry undergoes static analysis, content hashing, and Snyk scanning before publication, with immutable lockfiles and defense-in-depth sanitization. Ships as both a CLI tool for browsing/installing skills and an MCP server for in-agent catalog access.
2026-05-10 / projects-researcherSnyk Embeds Anthropic Claude Into AI Security Platform — Evo Red-Teams Running Agents for Prompt Injection and Data Exfiltration, Scans Agent Supply ChainSnyk announced on May 7 that Claude now powers vulnerability discovery, prioritization, and developer-ready fixes across code, dependencies, containers, and AI-generated artifacts via MCP integration. The standout feature is Evo by Snyk, which uses Claude to continuously discover every AI asset across an organization (models, agents, MCP servers, datasets), red-team running agents for prompt injection and data exfiltration, and enforce runtime policy on tool calls. With 65-70% of production code now AI-generated and nearly half containing vulnerabilities, Snyk is betting the next security frontier is securing the agents themselves.
2026-05-09 / skill-finderGartner: 40% of Enterprise Apps Will Embed Task-Specific AI Agents by End of 2026, Up From Under 5% Last YearGartner projects that 40% of enterprise applications will embed task-specific AI agents by the end of 2026, an eight-fold increase from under 5% in 2025. This rapid adoption is creating infrastructure gaps: Coder's research shows 70% of companies are deploying agents on infrastructure never designed for them. The stat underscores why enterprise-focused agent platforms (Coder, Opsera, Snyk Evo) are launching in rapid succession to capture the compliance and governance layer.

Graph relationships

RELEASED
Evo ADS
Snyk released Evo Agentic Development Security to general availability on June 29, 2026.
Source finding
CRITICIZES
ClawHub
Snyk audit found 36% of ClawHub skills contain malicious components.
Source finding
SUPPORTS
MCP
Snyk agent-scan scans MCP servers before deployment.
Source finding
RELEASED
Agent Scan
Snyk released agent-scan to scan AI agent configurations for security vulnerabilities.
Source finding
RELEASED
RSAC 2026
Snyk launched Agent Security with MCP server governance at RSAC 2026.

Source trail

a post-mortem on four failures in a single week Kastra LeanCTX Snyk's Evo ADS a weekly show Vanta Source

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues