https://cybertoolchain.io/tools/aikido-security New releases and features in Aikido Security, tracked by The Cyber Toolchain. en Thu, 29 Oct 2026 07:52:45 GMT https://help.aikido.dev/changelog/q4-2026/external-network-pentesting-test-your-perimeter-before-someone-else-does https://help.aikido.dev/changelog/q4-2026/external-network-pentesting-test-your-perimeter-before-someone-else-does Thu, 29 Oct 2026 07:52:45 GMT Aikido Security adds External Network Pentesting — AI agents map your perimeter and exploit findings from outside, with no code access or credentials required⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Aikido Security now offers an External Network Pentesting capability where AI agents discover subdomains, open ports, and services from a list of top-level domains, then attempt exploitation using known CVEs, misconfigurations, and exposed secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Agents chain findings across hosts — using credentials or access found on one system to pivot to the next — and the report shows the full attack path from entry point to impact. • Watch agents work in real time via the Agents tab, which shows each agent's current thinking, tools in use, and findings so far. • Run pentests in continuous mode so newly discovered subdomains are tested shortly after they go live. • Control test intensity by setting a maximum requests per second per target, or restrict testing to inside or outside business hours. • A scoping agent checks how much of each subdomain you own and limits testing to the parts you control, with all agent traffic routed through a proxy that blocks out-of-scope connections. • External network pentests produce an auditor-ready report in the same format as Aikido's web app and mobile pentests, covering the attack surface up to the login page. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q4-2026/external-network-pentesting-test-your-perimeter-before-someone-else-does https://help.aikido.dev/changelog/q4-2026/external-network-pentesting-test-your-perimeter-before-someone-else-does Thu, 29 Oct 2026 07:52:45 GMT Aikido Security adds External Network Pentesting — AI agents map your perimeter and exploit findings from outside, with no code access or credentials required⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Aikido Security now offers an External Network Pentesting capability where AI agents discover subdomains, open ports, and services from a list of top-level domains, then attempt exploitation using known CVEs, misconfigurations, and exposed secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Agents chain findings across hosts — using credentials or access found on one system to pivot to the next — and the report shows the full attack path from entry point to impact. • Watch agents work in real time via the Agents tab, which shows each agent's current thinking, tools in use, and findings so far. • Run pentests in continuous mode so newly discovered subdomains are tested shortly after they go live. • Control test intensity by setting a maximum requests per second per target, or restrict testing to inside or outside business hours. • A scoping agent checks how much of each subdomain you own and limits testing to the parts you control, with all agent traffic routed through a proxy that blocks out-of-scope connections. • External network pentests produce an auditor-ready report in the same format as Aikido's web app and mobile pentests, covering the attack surface up to the login page. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q4-2026/58-cloud-security-audits-external-network-pentesting-and-aikido-is-now-fedramp-moderate https://help.aikido.dev/changelog/q4-2026/58-cloud-security-audits-external-network-pentesting-and-aikido-is-now-fedramp-moderate Fri, 23 Oct 2026 07:56:31 GMT Aikido adds Cloud Security Audits, External Network Pentesting, FedRAMP Moderate authorization, Google SecOps integration, and new Zen Firewall agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new API endpoints: `API - List CWE descriptions` to retrieve CWE metadata, `API - List pending invites` to query outstanding user invitations, `API - List AI code analysis assessments` to fetch AI code analysis results, `API - List pentest assessments` to retrieve pentest findings, `API - Disable user` to deactivate users, and `API - Remove attach surface subdomain` to remove subdomains from the attack surface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New Google SecOps integration to optionally forward Aikido Activity logs to a SIEM. • Adds Zen Firewall agent releases for `Dotnet`, `Python`, `PHP`, `Ruby`, and `Node`. • Adds Hugging Face to supported malware ecosystems in Aikido Intel. • Adds Terraform `Container management resources` and publishes the Aikido provider to the OpenTofu registry. • Removes the maximum-rule restriction for Code Quality scans and enables auto-creation of PRs for issues found in full repository scans. • New Cloud Security Audit feature: AI agents reason across cloud and IaC configurations to surface multi-step attack paths and link each finding back to the causative template. • New External Network Pentest capability to scan internet-exposed assets — including forgotten subdomains and open admin panels — with evidence-confirmed findings. • Aikido for Government achieves FedRAMP Moderate authorization and is listed on the FedRAMP Marketplace, allowing federal agencies to adopt Aikido without a full security review. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q4-2026/58-cloud-security-audits-external-network-pentesting-and-aikido-is-now-fedramp-moderate https://help.aikido.dev/changelog/q4-2026/58-cloud-security-audits-external-network-pentesting-and-aikido-is-now-fedramp-moderate Fri, 23 Oct 2026 07:56:31 GMT Aikido adds Cloud Security Audits, External Network Pentesting, FedRAMP Moderate authorization, Google SecOps integration, and new Zen Firewall agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new API endpoints: `API - List CWE descriptions` to retrieve CWE metadata, `API - List pending invites` to query outstanding user invitations, `API - List AI code analysis assessments` to fetch AI code analysis results, `API - List pentest assessments` to retrieve pentest findings, `API - Disable user` to deactivate users, and `API - Remove attach surface subdomain` to remove subdomains from the attack surface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New Google SecOps integration to optionally forward Aikido Activity logs to a SIEM. • Adds Zen Firewall agent releases for `Dotnet`, `Python`, `PHP`, `Ruby`, and `Node`. • Adds Hugging Face to supported malware ecosystems in Aikido Intel. • Adds Terraform `Container management resources` and publishes the Aikido provider to the OpenTofu registry. • Removes the maximum-rule restriction for Code Quality scans and enables auto-creation of PRs for issues found in full repository scans. • New Cloud Security Audit feature: AI agents reason across cloud and IaC configurations to surface multi-step attack paths and link each finding back to the causative template. • New External Network Pentest capability to scan internet-exposed assets — including forgotten subdomains and open admin panels — with evidence-confirmed findings. • Aikido for Government achieves FedRAMP Moderate authorization and is listed on the FedRAMP Marketplace, allowing federal agencies to adopt Aikido without a full security review. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/deep-review-the-agentic-pr-review-that-cuts-merge-time-and-bugs-shipped https://help.aikido.dev/changelog/q3-2026/deep-review-the-agentic-pr-review-that-cuts-merge-time-and-bugs-shipped Thu, 24 Sep 2026 07:34:08 GMT Aikido adds Code Coverage: line-level test coverage for every repo, paired with code quality findings, accepting LCOV and Cobertura reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Code Quality > Code Coverage` section to the Aikido dashboard, showing per-repository, per-file, and per-line test coverage alongside existing code quality findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Accepts LCOV and Cobertura coverage report formats, with native support for outputs from Jest and pytest-cov. • Provides a GitHub Action and a GitLab CI component for uploading coverage reports to Aikido from CI pipelines, requiring no extra token or self-hosted component. • Supports merging split coverage reports across multiple services into a single view when multiple report files are passed in a single upload. • Integrates natively with GitHub, GitLab, Bitbucket, and Azure DevOps SCM platforms, with a custom integration path for other platforms. • Offers two file-browsing modes: a 'Code Tree' tab following directory structure and a 'File List' tab ranking files by coverage percentage. • Tracks coverage over time with a per-repository trend graph updated on each upload. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/deep-review-the-agentic-pr-review-that-cuts-merge-time-and-bugs-shipped-1 https://help.aikido.dev/changelog/q3-2026/deep-review-the-agentic-pr-review-that-cuts-merge-time-and-bugs-shipped-1 Thu, 24 Sep 2026 07:34:08 GMT Aikido launches Deep Review, an agentic PR reviewer that traces logic across repos and posts findings with suggested fixes directly on pull requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces Deep Review, an agentic pull request reviewer that reasons across your full codebase — including middleware, global config, and linked repositories — not just the diff.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Flags bugs and unintended side effects in addition to security findings on every pull request. • Saves accepted-risk and false-positive decisions to memory so future reviews reflect prior feedback. • Runs after existing PR checks (SAST, dependency checks) to build on their findings rather than repeat them. • Enabled per repository with configurable linked repos and a review level setting; billed at 1 credit ($1) per PR with unlimited re-reviews on the same PR and a configurable monthly spend cap. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/56-cloud-asset-map-creating-fix-prs-with-deep-review-and-code-coverage-on-gitlab https://help.aikido.dev/changelog/q3-2026/56-cloud-asset-map-creating-fix-prs-with-deep-review-and-code-coverage-on-gitlab Wed, 23 Sep 2026 07:34:34 GMT Aikido adds Cloud Asset Map, fix PRs from Deep Review comments, GitLab code coverage, on-prem pentest model, and new APIs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `GET` List user logins history API endpoint for auditing authentication activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Broker management API for programmatic control of broker configuration. • Adds webhook event for when a new issue ignore/snooze request is accepted or denied. • Adds webhook event for when a Domain scan finishes. • Introduces Cloud Inventory (Cloud Asset Map): see every cloud resource laid out by region and VPC, with exposure findings and firewall rules accessible in one click. • Enables creating fix pull requests directly from Deep Review: reply to a Deep Review comment requesting a fix and Aikido opens a new PR with the fix built on your current PR. • Supports Code Coverage upload from GitLab CI with per-file and per-line results visible in Aikido alongside existing GitHub coverage. • Launches Altar, Aikido's first open-weight security model built to run frontier-grade pentesting fully on-prem and air-gapped without sending data to third parties. • Adds Zen Firewall agent releases for Java, PHP, Golang, and Node. • Adds Alpine support for the Zen Firewall PHP agent. • Adds new JetBrains IDE plugin release with support for multi-repository scanning. • Adds new MCP tools: Get issue details including pentest information, Deep Review, and other SCA scanning tool data. • Adds support for grouped bar charts in Custom Reports. • Extends Container scanning Reachability to include BigQuery datasets. • Makes VM Reachability available for GCP in Cloud scanning. • Adds new infrastructure-focused checks to cloud scanning. • Supports creating Task Tracker issues for Code Quality findings. • Adds Firefox and Homebrew as new ecosystems in Device Protection. • Adds Sensitive Data information to DSPM. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/55-code-coverage-for-github-siem-integrations-and-pentest-for-ai-capabilities https://help.aikido.dev/changelog/q3-2026/55-code-coverage-for-github-siem-integrations-and-pentest-for-ai-capabilities Wed, 09 Sep 2026 07:33:09 GMT Aikido adds code coverage visibility, 11 SIEM integrations, AI pentesting, new API endpoints, and a Terraform provider update. • Adds `new resource to manage default PR checks` and `new resource to manage PR check settings` to the Aikido Terraform provider. • Adds `API - Manage defaults PR checks for new repos` endpoint to control default PR check configuration via the API. • Adds `API - Report export for PCI and DORA compliance` endpoint to export compliance reports programmatically. • Adds `API - Listing & handling inbox requests` endpoint to manage inbox requests via the API. • Adds Code Coverage for GitHub to surface which parts of your codebase ship with zero tests, with one-step setup and no secrets to manage. • Adds SIEM Integrations supporting 11 SIEMs, enabling Aikido issues to be forwarded and correlated with other organizational security data. • Adds Pentest for AI Capabilities targeting the OWASP Agentic Top 10 (including prompt injection and memory poisoning) for agents and LLM features. • Adds a new Firewall to Device Protection to block malicious domains. • Adds monthly billing limits and GitLab support to Deep Review. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/deep-review-the-agentic-pr-review-that-cuts-merge-time-and-bugs-shipped https://help.aikido.dev/changelog/q3-2026/deep-review-the-agentic-pr-review-that-cuts-merge-time-and-bugs-shipped Sat, 05 Sep 2026 07:32:32 GMT Aikido launches Deep Review, an agentic PR reviewer that traces logic across repos and posts findings with suggested fixes directly on pull requests. • Introduces Deep Review, an agentic pull request reviewer that reasons across your full codebase — including middleware, global config, and linked repositories — to catch deeply nested security issues, broken access control, business logic flaws, and cross-tenant data leaks. • Saves accepted-risk and false-positive decisions to memory so future reviews learn from prior feedback on the same repository. • Runs after existing PR checks (SAST and dependency checks) to build on their findings instead of repeating them, and is enabled and configured per repository with linkable related repos and a configurable review level. • Priced at 1 credit ($1) per PR from the Aikido Wallet with unlimited re-reviews on the same PR, and supports a configurable monthly spend cap. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/new-code-audit-pentest-grade-reasoning-on-your-source-code-no-environment-required. https://help.aikido.dev/changelog/q2-2026/new-code-audit-pentest-grade-reasoning-on-your-source-code-no-environment-required. Wed, 26 Aug 2026 09:03:22 GMT • Code Audit surfaces code-based evidence, root cause analysis, and remediation guidance, plus AI-powered AutoFix for creating remediation PRs in a few clicks. • Pricing shown upfront in credits before an audit starts, with cost calculated from the size and complexity of selected codebases. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/new-dpsm-find-data-exposure-risks-without-connecting-your-data-stores https://help.aikido.dev/changelog/q3-2026/new-dpsm-find-data-exposure-risks-without-connecting-your-data-stores Wed, 26 Aug 2026 09:03:22 GMT • New Data Exposure Audit capability uses LLM agents to trace sensitive data from sources (request bodies, uploads, DB reads, config, app logic) into sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) — all from already-connected repos. • Each Data Exposure Audit consumes credits from the Aikido Wallet. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/new-extreme-noise-reduction-for-secrets-and-cves https://help.aikido.dev/changelog/q3-2026/new-extreme-noise-reduction-for-secrets-and-cves Wed, 26 Aug 2026 09:03:22 GMT • Adds Secrets AutoTriage: an LLM agent that runs after entropy detection to assess whether a discovered secret is a real, exposed credential, determine its liveness and scope, and automatically ignore or escalate findings based on defined rules. • Adds CVE Exploitability Analysis: an LLM agent that evaluates whether a CVE is practically exploitable given how your codebase uses the affected package, then can automatically upgrade, downgrade, snooze, or ignore the finding. • Each AutoTriage and CVE Exploitability Analysis run is logged with a short rationale so teams can review what was analyzed and what actions the agent took. • Enables automated remediation actions — upgrading, downgrading, snoozing, or ignoring findings — driven by user-controlled rules and codebase-aware LLM reasoning. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/new-protect-company-devices-from-supply-chain-attacks https://help.aikido.dev/changelog/q2-2026/new-protect-company-devices-from-supply-chain-attacks Wed, 26 Aug 2026 09:03:22 GMT • Request-and-approval workflow pauses blocked installs and routes a one-click exception request to the admin Inbox inside Aikido. • Group-based policies enable different install rules per team. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/new-protect-company-devices-from-supply-chain-attacks https://help.aikido.dev/changelog/q2-2026/new-protect-company-devices-from-supply-chain-attacks Wed, 26 Aug 2026 09:03:22 GMT • Request-and-approval workflow pauses blocked installs and routes a one-click exception request to the admin Inbox inside Aikido. • Group-based policies enable different install rules per team. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/new-extreme-noise-reduction-for-secrets-and-cves https://help.aikido.dev/changelog/q3-2026/new-extreme-noise-reduction-for-secrets-and-cves Wed, 26 Aug 2026 09:03:22 GMT • Adds Secrets AutoTriage: an LLM agent that runs after entropy detection to assess whether a discovered secret is a real, exposed credential, determine its liveness and scope, and automatically ignore or escalate findings based on defined rules. • Adds CVE Exploitability Analysis: an LLM agent that evaluates whether a CVE is practically exploitable given how your codebase uses the affected package, then can automatically upgrade, downgrade, snooze, or ignore the finding. • Each AutoTriage and CVE Exploitability Analysis run is logged with a short rationale so teams can review what was analyzed and what actions the agent took. • Enables automated remediation actions — upgrading, downgrading, snoozing, or ignoring findings — driven by user-controlled rules and codebase-aware LLM reasoning. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/new-dpsm-find-data-exposure-risks-without-connecting-your-data-stores https://help.aikido.dev/changelog/q3-2026/new-dpsm-find-data-exposure-risks-without-connecting-your-data-stores Wed, 26 Aug 2026 09:03:22 GMT • New Data Exposure Audit capability uses LLM agents to trace sensitive data from sources (request bodies, uploads, DB reads, config, app logic) into sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) — all from already-connected repos. • Each Data Exposure Audit consumes credits from the Aikido Wallet. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/new-code-audit-pentest-grade-reasoning-on-your-source-code-no-environment-required. https://help.aikido.dev/changelog/q2-2026/new-code-audit-pentest-grade-reasoning-on-your-source-code-no-environment-required. Wed, 26 Aug 2026 09:03:22 GMT • Code Audit surfaces code-based evidence, root cause analysis, and remediation guidance, plus AI-powered AutoFix for creating remediation PRs in a few clicks. • Pricing shown upfront in credits before an audit starts, with cost calculated from the size and complexity of selected codebases. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/54-device-protection-for-linux-and-vm-scanning-for-google-cloud https://help.aikido.dev/changelog/q3-2026/54-device-protection-for-linux-and-vm-scanning-for-google-cloud Tue, 25 Aug 2026 13:17:11 GMT Aikido adds Linux device protection (.deb/.rpm), agentless GCP VM scanning, OSCAL FedRAMP DAST reports, and new bulk-configuration APIs. • New API to bulk update GitHub PR configuration across repositories. • New API to request a hardened container image. • Device Protection for Linux (beta): blocks malware at install time on Linux desktops and servers, distributed as `.deb` and `.rpm` packages. • GCP VM Scanning is now generally available — agentless setup with no SSH keys or agents required, completing coverage across AWS, Azure, and GCP. • Adds OSCAL FedRAMP DAST report format under Reports. • Zen Firewall agent releases now available for Dotnet, Java, PHP, Ruby, Golang, and Node. • CVE Exploitability assessment now supports containers. • Package Health adds support for NuGet and JetBrains packages. • Adds ability to request ignore of an issue on a PR/MR with admin approval. • Adds ability to ignore license issues by path. • New VSCode IDE extension release. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/new-code-audit-pentest-grade-reasoning-on-your-source-code-no-environment-required. https://help.aikido.dev/changelog/q2-2026/new-code-audit-pentest-grade-reasoning-on-your-source-code-no-environment-required. Tue, 25 Aug 2026 13:17:11 GMT Aikido adds Code Audit: agentic, pentest-grade source code reasoning with AutoFix PR generation, no live environment needed. • New Code Audit feature runs agentic, pentest-grade security reasoning directly on source code to find logic flaws (e.g. cross-tenant data leakage) that pattern-based scanners miss — no staging URL, traffic replay, or agent deployment required. • AutoFix generates remediation PRs from Code Audit findings with a few clicks, alongside root cause analysis and remediation guidance. • Code Audit is priced in credits shown upfront before the audit starts, with cost based on codebase size and complexity. • Supports hard-to-test-by-URL codebases including mobile apps, smart contracts, desktop apps, embedded software, and libraries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/new-dpsm-find-data-exposure-risks-without-connecting-your-data-stores https://help.aikido.dev/changelog/q3-2026/new-dpsm-find-data-exposure-risks-without-connecting-your-data-stores Tue, 25 Aug 2026 13:17:11 GMT Aikido adds code-based DSPM: Data Exposure Audit maps sensitive data flows through source code without connecting production data stores. • New Data Exposure Audit feature performs code-based DSPM using LLM agents to trace sensitive fields from sources (request bodies, DB reads, config) to sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) — no production data store access required. • Detects credentials in URLs — tokens and API keys in query strings, redirects, and clone URLs that may be captured by logs, proxies, or browser history. • Detects API over-exposure — endpoints returning more fields than the caller is entitled to, and missing tenant ownership checks. • Detects unsafe logging and exports — unredacted PII and secrets appearing in application logs, traces, caches, and dumps. • Detects over-broad third-party and AI sharing — customer data and secrets sent to vendors, analytics pipelines, LLM prompts, and vector stores. • Detects weak storage — regulated data stored unencrypted, or protected only with base64, MD5, or SHA-1. • Detects incomplete deletion — delete flows that leave downstream records, caches, and related stores intact, including shadow copies in staging and snapshots. • Detects over-permissioned IAM roles and OAuth scopes, and unauthenticated data stores. • Runs against already-connected repositories with no new data source to onboard; each audit consumes credits from the Aikido Wallet. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/new-extreme-noise-reduction-for-secrets-and-cves https://help.aikido.dev/changelog/q3-2026/new-extreme-noise-reduction-for-secrets-and-cves Tue, 25 Aug 2026 13:17:11 GMT Aikido adds LLM-powered Secrets AutoTriage and CVE Exploitability Analysis to automatically prioritize and act on findings. • New Secrets AutoTriage agent runs after entropy detection to assess whether a discovered secret is a real, exposed credential — evaluating liveness, scope, and surrounding code context — then applies defined rules or LLM reasoning for ambiguous cases. • New CVE Exploitability Analysis agent evaluates whether a CVE is actually reachable and exploitable in your codebase using LLM reasoning over how your code uses the affected package. • Both agents can act autonomously: upgrading, downgrading, snoozing, or ignoring findings automatically based on rules you control. • Each agent run is logged with a short rationale explaining what was analyzed and what actions were taken, allowing teams to review and override decisions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/new-protect-company-devices-from-supply-chain-attacks https://help.aikido.dev/changelog/q2-2026/new-protect-company-devices-from-supply-chain-attacks Tue, 25 Aug 2026 13:17:11 GMT Aikido Device Protection agent adds real-time malware blocking, extension governance, group policies, and an approval workflow for developer devices. • New Device Protection agent provides real-time malware blocking across npm, PyPI, Maven, and NuGet package managers, powered by Aikido Intel. • Adds extension governance covering VS Code, OpenVSX, Chrome, and skills.sh extensions. • Introduces a request-and-approval workflow: blocked installs trigger a one-click exception request reviewable inside the Aikido admin Inbox. • Supports group-based policies, enabling different package and extension rules per team. • Adds continuous device inventory giving an always-current view of every package and extension installed per device. • Agent runs silently in the background and surfaces desktop notifications only when a package is blocked (malware or policy) or held for approval. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/new-code-audit-pentest-grade-reasoning-on-your-source-code-no-environment-required. https://help.aikido.dev/changelog/q2-2026/new-code-audit-pentest-grade-reasoning-on-your-source-code-no-environment-required. Tue, 25 Aug 2026 13:17:11 GMT Aikido adds Code Audit: agentic, pentest-grade source code reasoning with AutoFix PR generation, no live environment needed. • New Code Audit feature runs agentic, pentest-grade security reasoning directly on source code to find logic flaws (e.g. cross-tenant data leakage) that pattern-based scanners miss — no staging URL, traffic replay, or agent deployment required. • AutoFix generates remediation PRs from Code Audit findings with a few clicks, alongside root cause analysis and remediation guidance. • Code Audit is priced in credits shown upfront before the audit starts, with cost based on codebase size and complexity. • Supports hard-to-test-by-URL codebases including mobile apps, smart contracts, desktop apps, embedded software, and libraries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/new-dpsm-find-data-exposure-risks-without-connecting-your-data-stores https://help.aikido.dev/changelog/q3-2026/new-dpsm-find-data-exposure-risks-without-connecting-your-data-stores Tue, 25 Aug 2026 13:17:11 GMT Aikido adds code-based DSPM: Data Exposure Audit maps sensitive data flows through source code without connecting production data stores. • New Data Exposure Audit feature performs code-based DSPM using LLM agents to trace sensitive fields from sources (request bodies, DB reads, config) to sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) — no production data store access required. • Detects credentials in URLs — tokens and API keys in query strings, redirects, and clone URLs that may be captured by logs, proxies, or browser history. • Detects API over-exposure — endpoints returning more fields than the caller is entitled to, and missing tenant ownership checks. • Detects unsafe logging and exports — unredacted PII and secrets appearing in application logs, traces, caches, and dumps. • Detects over-broad third-party and AI sharing — customer data and secrets sent to vendors, analytics pipelines, LLM prompts, and vector stores. • Detects weak storage — regulated data stored unencrypted, or protected only with base64, MD5, or SHA-1. • Detects incomplete deletion — delete flows that leave downstream records, caches, and related stores intact, including shadow copies in staging and snapshots. • Detects over-permissioned IAM roles and OAuth scopes, and unauthenticated data stores. • Runs against already-connected repositories with no new data source to onboard; each audit consumes credits from the Aikido Wallet. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/new-protect-company-devices-from-supply-chain-attacks https://help.aikido.dev/changelog/q2-2026/new-protect-company-devices-from-supply-chain-attacks Tue, 25 Aug 2026 13:17:11 GMT Aikido Device Protection agent adds real-time malware blocking, extension governance, group policies, and an approval workflow for developer devices. • New Device Protection agent provides real-time malware blocking across npm, PyPI, Maven, and NuGet package managers, powered by Aikido Intel. • Adds extension governance covering VS Code, OpenVSX, Chrome, and skills.sh extensions. • Introduces a request-and-approval workflow: blocked installs trigger a one-click exception request reviewable inside the Aikido admin Inbox. • Supports group-based policies, enabling different package and extension rules per team. • Adds continuous device inventory giving an always-current view of every package and extension installed per device. • Agent runs silently in the background and surfaces desktop notifications only when a package is blocked (malware or policy) or held for approval. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/new-extreme-noise-reduction-for-secrets-and-cves https://help.aikido.dev/changelog/q3-2026/new-extreme-noise-reduction-for-secrets-and-cves Tue, 25 Aug 2026 13:17:11 GMT Aikido adds LLM-powered Secrets AutoTriage and CVE Exploitability Analysis to automatically prioritize and act on findings. • New Secrets AutoTriage agent runs after entropy detection to assess whether a discovered secret is a real, exposed credential — evaluating liveness, scope, and surrounding code context — then applies defined rules or LLM reasoning for ambiguous cases. • New CVE Exploitability Analysis agent evaluates whether a CVE is actually reachable and exploitable in your codebase using LLM reasoning over how your code uses the affected package. • Both agents can act autonomously: upgrading, downgrading, snoozing, or ignoring findings automatically based on rules you control. • Each agent run is logged with a short rationale explaining what was analyzed and what actions were taken, allowing teams to review and override decisions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/54-device-protection-for-linux-and-vm-scanning-for-google-cloud https://help.aikido.dev/changelog/q3-2026/54-device-protection-for-linux-and-vm-scanning-for-google-cloud Tue, 25 Aug 2026 13:17:11 GMT Aikido adds Linux device protection (.deb/.rpm), agentless GCP VM scanning, OSCAL FedRAMP DAST reports, and new bulk-configuration APIs. • New API to bulk update GitHub PR configuration across repositories. • New API to request a hardened container image. • Device Protection for Linux (beta): blocks malware at install time on Linux desktops and servers, distributed as `.deb` and `.rpm` packages. • GCP VM Scanning is now generally available — agentless setup with no SSH keys or agents required, completing coverage across AWS, Azure, and GCP. • Adds OSCAL FedRAMP DAST report format under Reports. • Zen Firewall agent releases now available for Dotnet, Java, PHP, Ruby, Golang, and Node. • CVE Exploitability assessment now supports containers. • Package Health adds support for NuGet and JetBrains packages. • Adds ability to request ignore of an issue on a PR/MR with admin approval. • Adds ability to ignore license issues by path. • New VSCode IDE extension release. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/53-deep-review-android-pentests-custom-reports-and-free-credits https://help.aikido.dev/changelog/q3-2026/53-deep-review-android-pentests-custom-reports-and-free-credits Wed, 12 Aug 2026 19:01:05 GMT Aikido #53 adds agentic PR deep review, Android pentesting, custom AI-built reports, and free monthly credits. • New Deep Review feature performs agentic PR analysis that goes beyond the diff, examining surrounding code and linked repositories to catch business logic mistakes and cross-service security issues. • Aikido Pentest now covers native and hybrid Android apps, including those with biometric login. • New Custom Reports capability lets users describe a report in plain language; Aikido Agent builds it from findings and makes it shareable across the workspace. • Pro and Advanced plans now receive 100–200 free Aikido Credits per month for use with Deep Review and Security Audit. • Adds an Aikido Terraform provider integration. • New API surface to read and update AutoFix settings. • Adds Zen Firewall agents for PHP and Ruby. • Adds new IDE extensions for VSCode and Visual Studio. • GitLab integration now supports resolving issues. • Adds per-repository bypass of PR checks in Training mode. • Kubernetes team annotations are now surfaced as container labels in Cloud. • Kubernetes agents now have FIPS variants. • Adds a repository filter for trends-over-time in Reports. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/new-dpsm-find-data-exposure-risks-without-connecting-your-data-stores https://help.aikido.dev/changelog/q3-2026/new-dpsm-find-data-exposure-risks-without-connecting-your-data-stores Wed, 12 Aug 2026 19:01:05 GMT Aikido adds code-based DSPM: Data Exposure Audit maps sensitive data flows through source code without connecting production data stores. • New Data Exposure Audit feature performs code-based DSPM by using LLM agents to trace sensitive data from sources (request bodies, uploads, DB reads, config, application logic) to sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) — no production data store connection required. • Detects credentials in URLs, API over-exposure (endpoints returning excess fields, missing tenant ownership checks), unsafe logging of unredacted PII and secrets, over-broad third-party and AI data sharing, weak storage (unencrypted regulated data, base64/MD5/SHA-1 misused as encryption), and incomplete deletion flows leaving downstream records and caches intact. • Runs against already-connected repositories with no new data source to onboard; each Data Exposure Audit consumes credits from the Aikido Wallet. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/new-dpsm-find-data-exposure-risks-without-connecting-your-data-stores https://help.aikido.dev/changelog/q3-2026/new-dpsm-find-data-exposure-risks-without-connecting-your-data-stores Tue, 04 Aug 2026 10:51:56 GMT Aikido adds code-based DSPM: map sensitive data flows and find exposure risks without connecting production data stores. • New Data Exposure Audit feature uses LLM agents to trace sensitive data from sources (request bodies, uploads, DB reads, config, application logic) to sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) — entirely from code, with no production data store connection required. • Detects credential and token leakage in URLs, query strings, redirects, and clone URLs where logs, proxies, and browser history can capture them. • Identifies API over-exposure: endpoints returning more fields than the caller is entitled to, and missing tenant ownership checks on data access. • Flags unsafe logging and exports: unredacted PII and secrets in application logs, traces, caches, and dumps. • Surfaces over-broad third-party and AI data sharing: customer data and secrets sent to vendors, analytics, LLM prompts, and vector stores beyond what is required. • Detects weak storage patterns: regulated data stored unencrypted, or with base64, MD5, or SHA-1 used in place of real encryption. • Finds incomplete deletion flows that leave downstream records, caches, and related stores intact, including shadow copies in staging and snapshots. • Each Data Exposure Audit consumes credits from the Aikido Wallet. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/new-dpsm-find-data-exposure-risks-without-connecting-your-data-stores https://help.aikido.dev/changelog/q3-2026/new-dpsm-find-data-exposure-risks-without-connecting-your-data-stores Tue, 04 Aug 2026 10:51:56 GMT Aikido adds code-based DSPM: map sensitive data flows and find exposure risks without connecting production data stores. • New Data Exposure Audit feature uses LLM agents to trace sensitive data from sources (request bodies, uploads, DB reads, config, application logic) to sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) — entirely from code, with no production data store connection required. • Detects credential and token leakage in URLs, query strings, redirects, and clone URLs where logs, proxies, and browser history can capture them. • Identifies API over-exposure: endpoints returning more fields than the caller is entitled to, and missing tenant ownership checks on data access. • Flags unsafe logging and exports: unredacted PII and secrets in application logs, traces, caches, and dumps. • Surfaces over-broad third-party and AI data sharing: customer data and secrets sent to vendors, analytics, LLM prompts, and vector stores beyond what is required. • Detects weak storage patterns: regulated data stored unencrypted, or with base64, MD5, or SHA-1 used in place of real encryption. • Finds incomplete deletion flows that leave downstream records, caches, and related stores intact, including shadow copies in staging and snapshots. • Each Data Exposure Audit consumes credits from the Aikido Wallet. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/52-dspm-aikido-libraries-and-repository-code-quality-scans https://help.aikido.dev/changelog/q3-2026/52-dspm-aikido-libraries-and-repository-code-quality-scans Fri, 31 Jul 2026 15:56:18 GMT Aikido adds DSPM, backport CVE patches via Aikido Libraries, code quality repo scans, and new language firewall agents. • New Data Exposure Audit (DSPM) feature tracks how sensitive data flows and where it gets exposed, reading entirely from source code — no database connections or data access grants required. • New Aikido Libraries capability delivers PRs that backport open-source CVE fixes to the exact version already running, avoiding major-version bumps or breaking changes. • New Code Quality Repository Scans surface existing code quality issues across repos to help find and prioritize technical debt over time. • Noise reduction for container images in cloud scanning reduces alert fatigue. • Bitbucket Server support added for PR Checks. • Kubernetes registry option added for public image scanning. • Code Quality PR/MR Gating by Severity enables blocking merges based on issue severity. • New Code Quality rule: 'Keep the diff minimal'. • Device Protection now supports JetBrains Zen. • Firewall agents released for PHP, Ruby, Golang, and Node. • IDE extensions updated with new releases for VSCode, JetBrains, and Visual Studio. • Health score for the Maven ecosystem added to Aikido Intel. • Bulk assignment of cloud accounts to teams now available in Settings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/52-dspm-aikido-libraries-and-repository-code-quality-scans https://help.aikido.dev/changelog/q3-2026/52-dspm-aikido-libraries-and-repository-code-quality-scans Tue, 28 Jul 2026 16:00:09 GMT Aikido adds DSPM, backport library patches, code quality scans, and new agent/IDE releases in one drop. • New Data Exposure Audit (DSPM) scans repos to track how sensitive data flows and where it gets exposed — no database connections or data access grants required. • New Aikido Libraries capability delivers backported CVE fixes for the exact dependency version already in use, without requiring major-version upgrades or refactors. • New Code Quality Repository Scans surface existing code quality issues across repos to help identify and prioritize technical debt over time. • Noise reduction for container images in Cloud scans. • Bitbucket Server support added for PR Checks. • Kubernetes registry option added for public image scanning. • PR/MR gating by severity now available on GitHub for Code Quality findings. • Device Protection adds support for JetBrains Zen. • Firewall agents now available for PHP, Ruby, Golang, and Node. • IDE extensions updated with new releases for VSCode, JetBrains, and Visual Studio. • Health score added for the Maven ecosystem in Aikido Intel. • Bulk assignment of cloud accounts to teams available in Settings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/51-repository-code-quality-scans-ignore-approval-inbox-and-noise-reduction-for-secrets-and-cves https://help.aikido.dev/changelog/q3-2026/51-repository-code-quality-scans-ignore-approval-inbox-and-noise-reduction-for-secrets-and-cves Wed, 15 Jul 2026 01:22:55 GMT Aikido #51 adds repository-wide code quality scans, an ignore approval inbox, AI-powered noise reduction for secrets & CVEs, and a wave of new integrations and APIs. • New Code Quality Repository Scan (early access): scan entire codebases for quality issues, monitor trends, and identify refactoring hotspots — not just PR-level checks. • New Approval Inbox for Ignores: routes every ignore request through a central inbox requiring admin sign-off before issues leave the feed. • New AI-powered Noise Reduction for Secrets & CVEs: analyzes each secret and CVE against actual code to surface only truly exploitable findings and suppress irrelevant ones. • New Dashboard available to all users. • Adds Azure DevOps Self-Managed Server support for source code scanning. • Adds ticket integration support for GitHub Server and Azure DevOps Cloud. • Adds Render cloud misconfiguration scanning. • Adds Kubernetes namespace labels to container metadata. • Adds Terraform module for GCP project/organization onboarding. • Device Protection can now be temporarily disabled for up to 1 hour. • Adds Google Cloud Artifact Registry Proxy support. • Zen Firewall Node agent adds ElysiaJS framework support. • IDE extensions updated for VSCode and JetBrains, including new JetBrains CLion support. • New API endpoint to list snoozed and ignored issues from PRs. • New API endpoint to retrieve Device Protection SBOM. • New API endpoint to get SLA settings. • New API endpoint for GDPR reports. • New API endpoints to get, add, update, and remove container labels. • New API endpoint to list repository PR configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q4-2025/41-aikido-mcp-re-testing-ai-pentest-findings-and-azure-management-group-support https://help.aikido.dev/changelog/q4-2025/41-aikido-mcp-re-testing-ai-pentest-findings-and-azure-management-group-support Mon, 13 Jul 2026 10:06:51 GMT Aikido adds MCP for AI-driven security workflows, AI Pentest re-testing, Azure Management Group auto-discovery, and a wave of new integrations. • New Aikido MCP integration lets AI agents analyze code for security risks and fixes locally, without sending code or data to the cloud. • New re-test capability for individual AI Pentest findings lets teams confirm a specific fix is resolved without running a full pentest. • New Azure Management Group support: connect once and Aikido auto-discovers all existing and future groups and subscriptions. • New Broker Helm chart released for self-hosted broker deployments. • New GitHub Enterprise Server on-premises support via Aikido Broker for code scanning. • New AutoFix support for Bun runtime. • New malware detection in container images. • New Kubernetes checks for ingress-nginx and MongoDB. • New GraphQL support in AI Pentest. • Code Quality scanning now automatically ignores generated files. • New ability to link domains directly to teams in Domains & APIs. • New custom headers support for API scans in Domains & APIs. • New OTP/2FA support for authenticated API scanning in Domains & APIs. • New local scanner release for Virtual Machines. • New Zen Firewall agent releases for Dotnet, Java, Python, PHP, Ruby, and Node. • New IDE extension releases for VSCode, JetBrains, and Visual Studio. • Safe-chain adds full Python support (pip, pipx, uv, poetry) and CircleCI support, plus configurable custom/private npm registries. • New email forwarding support for Notifications. • New FDA/NTIA-compliant reports with component hashes and supplier information. • New API endpoint to add a Kubernetes cluster. • New API endpoint to start a scan on a code repository. • New API endpoint to list all CI scans. • New API endpoint to get issue reachability analysis. • New API endpoint to add a note to an issue group. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q1-2026/42-dep-upgrade-analysis-eclipse-ide-ai-pentest-preview-and-real-time-kubernetes-image-scanning https://help.aikido.dev/changelog/q1-2026/42-dep-upgrade-analysis-eclipse-ide-ai-pentest-preview-and-real-time-kubernetes-image-scanning Mon, 13 Jul 2026 10:06:51 GMT Aikido adds Kubernetes real-time image scanning, Eclipse IDE plugin, AI pentest preview, and dependency upgrade breaking-change analysis. • New Dependency Upgrade Breaking Change Analysis: Aikido AutoFix surfaces code-breaking impacts of dependency upgrades before they are applied. • New Kubernetes In-Cluster Image Scanning: continuously monitors container images running in live Kubernetes clusters for vulnerabilities. • New AI Pentest Skip-Payment model: run a full whitebox pentest and pay only to unlock details of High or Critical findings. • New Eclipse IDE plugin: scans projects in real time for secrets, API keys, and security vulnerabilities as you code. • New and improved Reachability view: refreshed design with deeper, more granular insights accessible directly from the Feed on hover. • Adds Visual Basic.NET support to Code Scanning. • Adds Clojure support to Code Scanning. • Adds Azure China support for Cloud scanning. • New Zen Firewall agent releases for Dotnet, Java, Python, PHP, Ruby, Golang, and Node. • Enables editing of Custom Rules in Code Quality. • AI Pentest now estimates the number of agents needed for optimal coverage. • AI Pentest supports programmatic creation of new pentests via API. • AI Pentest supports scheduling for weekend execution. • AI Pentest now suggests hardening improvements to code. • IntelliJ IDE plugin adds Full Codebase Scan capability. • New IDE feature to track Expansion Pack (Secrets, Safe-Chain, MCP) usage across the organization. • New IDE releases for VSCode, JetBrains, and Visual Studio. • Safe-Chain adds custom registry support for Python and Jenkins support. • New compliance integration with CompAI. • New Reports: UK Cyber Essentials. • New API endpoint to start a container scan. • New API endpoint to set network connectivity for a repository. • New API endpoint to list tasks related to a group. • New API endpoint to get AI Pentest assessment details. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q1-2026/43-aikido-infinite-continuous-pentesting-interactive-vm-reachability-diagrams-and-ide-full-scan https://help.aikido.dev/changelog/q1-2026/43-aikido-infinite-continuous-pentesting-interactive-vm-reachability-diagrams-and-ide-full-scan Mon, 13 Jul 2026 10:06:51 GMT Aikido adds continuous pentesting, VM reachability diagrams, full IDE workspace scanning, and expanded integrations. • New Aikido Infinite (Continuous Pentesting): automatically re-tests your app after every code change, focusing on what changed and validating exploitability to reduce false positives. • New Reachability Diagrams for Cloud VMs: visualizes whether a finding is exploitable by mapping the network path, entry points, and exposed ports in your cloud environment. • Full Workspace Scan now available across all supported IDEs (VS Code, JetBrains, Visual Studio, Eclipse, Cursor), with IaC scanning added for VS Code. • Adds package health scoring for PHP and malware detection for skills.sh, Go, Rust, and WordPress plugins. • Container image scanning supports include/exclude filtering by pattern. • Kubernetes image scanning now supports multiple tags of the same image per cluster. • AI Pentest agent gains file upload support and SMS-based two-factor authentication and OAuth Password Grant flows. • Zen runtime protection releases Go beta and Ruby full release, plus IDOR blocking in Node.js. • Jira integration supports setting Custom Fields on issues. • Slack integration updated with direct actions from Slack notifications and an improved detail view. • New Comp AI integration for Governance, Risk, and Compliance (GRC). • New API endpoints: save pull request config for Azure, Bitbucket, and GitHub; adjust group severity; add subdomains to attack surface domains. • GitHub PR integration supports ignoring security issues and code quality findings directly from within a PR. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q1-2026/44-talk-to-aikido-autofix-pentest-threat-model-and-support-for-alibaba-cloud https://help.aikido.dev/changelog/q1-2026/44-talk-to-aikido-autofix-pentest-threat-model-and-support-for-alibaba-cloud Mon, 13 Jul 2026 10:06:51 GMT Aikido adds conversational AutoFix refinement, Pentest Threat Model, Alibaba Cloud support, and new APIs in release #44. • Adds 'Refine with Aikido AI' — iteratively adjust AutoFixes using natural language to match your code style without leaving Aikido. • New Pentest Threat Model provides a real-time, transparent view of your attack surface and how your application's security posture will be tested. • Supports Alibaba Cloud: scan for misconfigurations, exposed resources, and risky settings across your Alibaba Cloud environment. • Adds custom context on SAST rules to improve AutoTriage accuracy. • Displays CVEs on VM attack path diagrams in Cloud & VM views. • Introduces Aikido Claude Plugin via MCP integration. • Adds Jira/task tracker integration with team-to-project mapping and custom priority mapping. • Releases Zen Firewall agents for .NET, Java, Python, and Golang. • Releases IDE extensions for VSCode and JetBrains. • Sponsors Betterleaks (next Gitleaks iteration) delivering 5.2× better performance and improved accuracy. • New API endpoint to list attack surface subdomains. • New API webhook for manual severity changes. • New API endpoint to unlink a container from a repository. • New API endpoint to get AI Pentest issue details. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/45-aikido-lovable-vibe-fix-ship-and-container-reachability https://help.aikido.dev/changelog/q2-2026/45-aikido-lovable-vibe-fix-ship-and-container-reachability Mon, 13 Jul 2026 10:06:51 GMT Aikido adds Lovable pentesting integration, container network reachability, new APIs, and expanded Zen Firewall agent support. • Adds Container Reachability: maps the complete network route to running containers and surfaces CVEs in deployment context, showing what is exposed to the internet. • Detects org.opencontainers.image.source tags in Docker images for improved container identification. • Extends Virtual Machine Reachability support to Azure. • Refreshes Zen Firewall installation flow with new installation instructions. • Ships Zen Firewall agents for .NET, PHP, Ruby, Golang, and Node. • Automatically links SAML users to GitHub teams in User Management. • Adds Drupal malware scanning to Aikido Intel. • Releases new Safe Chain version with minimum package age support for Python. • Publishes new IDE extensions for VSCode and Visual Studio. • New API endpoints to manage webhooks, manage excluded paths per repository, and set custom headers for webhooks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/46-escalating-your-ai-pentest-and-additional-context-for-autotriage https://help.aikido.dev/changelog/q2-2026/46-escalating-your-ai-pentest-and-additional-context-for-autotriage Mon, 13 Jul 2026 10:06:51 GMT Aikido adds AI pentest escalation, AutoTriage custom context, cloud reachability for GCP, and new Zen firewall agents. • Enables escalation of AI pentest vulnerabilities beyond default cautious mode to perform deeper exploitation analysis and confirm whether protection layers hold up. • Adds custom environment context input for AutoTriage to improve finding accuracy and reduce false positives. • New 'out of SLA' graph added to Reports Trends Over Time view. • Supports direct reply or ignore actions via GitLab MR comments integration. • Extends cloud reachability analysis for containers to Google Cloud Run. • Supports custom context for AutoFix via an `.aikido` configuration file. • Adds additional pentest login methods: files, keys, and scripts. • Adds broker support for WebSockets in integrations. • Enables exclusion of specific users from Zen rate limiting. • Releases Zen Firewall agents for .NET, Go, and Node. • Releases new IDE extensions for VSCode, JetBrains, and Visual Studio. • New API endpoint to add Azure Container Registry. • New API endpoint to add GCP registry. • Updates headers for the Domain Scan API. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/47-aikido-device-protection-and-aikido-ai-chat https://help.aikido.dev/changelog/q2-2026/47-aikido-device-protection-and-aikido-ai-chat Mon, 13 Jul 2026 10:06:51 GMT Aikido adds Device Protection for blocking malicious packages on developer machines, AI Chat in AutoFix, and new API endpoints. • New Device Protection agent blocks malicious packages (npm, PyPI, Maven, NuGet, and more) and risky IDE/browser extensions at install time on developer devices to stop supply chain attacks. • Aikido AI Chat is now embedded in the AutoFix & Code Analysis Modal, enabling natural-language interaction with security findings and in-product AutoFix PR customization. • Adds cloud support for detecting Supabase common configuration issues. • Enables custom context for AutoFix via `.aikido` files. • Aikido Infinite now supports custom scan frequencies (e.g., every 6 weeks). • Zen Firewall agents released for Dotnet, Python, PHP, Ruby, Golang, and Node; Ruby agent adds Outbound Request Blocking support. • New IDE extension releases for VSCode, JetBrains, and Eclipse. • New API endpoint: List Cloud rules. • New API endpoint: Get project/repository mapping. • New API endpoint: Get CIS and AWS CIS report. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/48-ai-code-audit-aikido-mcp-and-servicenow-integration https://help.aikido.dev/changelog/q2-2026/48-ai-code-audit-aikido-mcp-and-servicenow-integration Mon, 13 Jul 2026 10:06:51 GMT Aikido adds AI code auditing, MCP integration, ServiceNow ticketing, Oracle/Alibaba cloud support, and Zen Firewall agent expansion. • New AI Code Audit capability performs pentest-grade reasoning on source code to catch logic flaws and vulnerabilities that traditional scanners miss — activated by connecting a repo. • New Aikido MCP integration lets AI coding assistants (e.g. Cursor, Claude) query Aikido issues — critical findings, leaked secrets, and open vulnerabilities — directly from the coding environment. • New ServiceNow integration automatically converts security findings into ServiceNow tickets, routing them into existing team workflows. • Adds CVE lookup via Aikido's chat interface for rapid vulnerability research. • Adds release gating with SLA Mode for code scanning, enabling enforcement of security SLAs at the pipeline level. • Adds Oracle Cloud support with 50+ detection rules for cloud security scanning. • Adds support for onboarding an entire Alibaba Cloud organization. • Adds GCP support for VM scanning. • Adds Pentest Pause and Pentest Monorepo support. • Adds Golang ecosystem support to Device Protection. • Adds Slack and Microsoft Teams inbox notifications for Device Protection. • Adds macOS silent install support for MDM deployment in Device Protection. • Expands Zen Firewall Agent to .NET, Java, PHP, Ruby, Golang, and Node runtimes. • New Zen Firewall view to inspect why a specific IP is being blocked. • New IDE releases for VSCode, JetBrains, and Visual Studio with added IaC scanning support in JetBrains. • New API endpoints: List Licenses, List Malware, and Get IDE/MCP usage statistics. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/49-visualize-threat-models-device-protection-for-windows-and-labels-on-repositories-and-containers https://help.aikido.dev/changelog/q2-2026/49-visualize-threat-models-device-protection-for-windows-and-labels-on-repositories-and-containers Mon, 13 Jul 2026 10:06:51 GMT Aikido #49 adds threat model diagrams, Windows device protection, repo/container labels, and a wave of new API endpoints. • New threat model visualization: every AI pentest and code audit now ships an architecture diagram showing roles and trust boundaries. • Device Protection now supports Windows, including MDM rollout for fleet-wide deployment. • New Labels feature lets you attach arbitrary metadata (business unit, PII, region, etc.) to repositories and container images and filter your issue feed by those labels. • Code Audit gains a Retest capability to re-evaluate issues after code changes. • Endpoint feature adds device SBOM export. • Zen Firewall adds agents for .NET, PHP, Ruby, and Golang (in addition to existing Node support). • Package Proxy adds malware scanning for private registries. • New CIS Kubernetes Benchmark report available. • MCP v1.0.8 adds a new 'search repositories' tool. • Task Trackers now support specifying which repository tasks should be created for, across all task managers. • Task Trackers now support configuration of multiple task trackers simultaneously. • New API endpoints: List Zen Users; Add Exception; List Devices, Activity Logs, Exceptions, and Permission Groups for Device Protection; Export Single Repository Report; List Notes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/50-agentic-dependency-autofix-registry-proxy-and-device-protection-adds-ruby-and-rust https://help.aikido.dev/changelog/q2-2026/50-agentic-dependency-autofix-registry-proxy-and-device-protection-adds-ruby-and-rust Mon, 13 Jul 2026 10:06:51 GMT Aikido adds agentic dependency AutoFix, a registry proxy for malware blocking, and Ruby/Rust device protection. • New Agentic Dependency AutoFix automatically resolves complex, interlocking dependency interactions on your behalf. • New Registry Proxy routes your private registry through Aikido to block malware and risky new packages and serve safe, patched versions before they reach your codebase. • Device Protection now covers Ruby (gems) and Rust (crates), blocking malware on install and adding them to your device SBOM. • Continuous Pentest adds Azure support for cloud environment scanning. • Continuous Pentest now supports selecting specific branches for 'On Schedule' runs. • Supports importing labels directly from GitHub. • MCP integration updated with a new auth flow plus workspace, branch, and team filters. • Code Audit enables adding additional custom instructions before an audit begins. • Zen Firewall adds new agents for .NET, Python, PHP, Golang, and Node. • New IDE plugin releases for JetBrains. • API now supports managing labels on repositories. • API now supports listing container runners. • AI Pentest adds a Letter of Attestation capability. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/new-code-audit-pentest-grade-reasoning-on-your-source-code-no-environment-required. https://help.aikido.dev/changelog/q2-2026/new-code-audit-pentest-grade-reasoning-on-your-source-code-no-environment-required. Mon, 13 Jul 2026 10:06:51 GMT Aikido launches Code Audit: agentic pentest-grade source code reasoning that finds logic flaws without a live environment. • New Code Audit feature applies agentic, pentest-grade reasoning directly to source code to detect logic flaws — such as cross-tenant data leakage — that pattern-based scanners miss. • Supports codebases that are difficult to test via URL: mobile apps, smart contracts, desktop apps, embedded software, and libraries. • Integrates with Aikido's existing issue experience: findings include code-based evidence, root cause analysis, remediation guidance, and AI-powered AutoFix for opening remediation PRs. • Upfront credit-based pricing displayed before audit starts, with cost scaled to codebase size and complexity — no hidden setup costs. • Requires no staging environment, traffic replay, or agent deployment — connect a repo and start the audit immediately. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q3-2026/new-extreme-noise-reduction-for-secrets-and-cves https://help.aikido.dev/changelog/q3-2026/new-extreme-noise-reduction-for-secrets-and-cves Mon, 13 Jul 2026 10:06:51 GMT Aikido adds LLM-powered AutoTriage for secrets and CVEs to cut noise and automate prioritization decisions. • New Secrets AutoTriage agent: assesses whether a detected secret is a real, exposed credential and evaluates its liveness and scope to determine actionable risk. • New CVE Exploitability Analysis agent: uses LLM reasoning against your actual codebase to determine whether a CVE is reachable and how urgently it must be addressed. • Automated remediation actions: the CVE agent can upgrade, downgrade, snooze, or ignore findings automatically based on configurable rules. • Audit log per run: every agent analysis is logged with a short rationale so teams can review decisions and override them. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/new-protect-company-devices-from-supply-chain-attacks https://help.aikido.dev/changelog/q2-2026/new-protect-company-devices-from-supply-chain-attacks Mon, 13 Jul 2026 10:06:51 GMT Aikido launches Device Protection: real-time malware blocking, extension governance, and group-based policies for developer devices. • New Device Protection agent provides real-time malware blocking across npm, PyPI, Maven, and NuGet package ecosystems powered by Aikido Intel. • Adds extension governance covering VS Code, OpenVSX, Chrome, and skills.sh extensions with policy-based controls. • New request-and-approval workflow pauses blocked installs and routes one-click exception requests to the admin Inbox inside Aikido. • Supports group-based policies allowing different installation rules to be set per team. • Continuous device inventory delivers an always-current view of every package and extension installed per developer device. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/49-visualize-threat-models-device-protection-for-windows-and-labels-on-repositories-and-containers https://help.aikido.dev/changelog/q2-2026/49-visualize-threat-models-device-protection-for-windows-and-labels-on-repositories-and-containers Mon, 15 Jun 2026 00:00:00 GMT Visualized threat model diagrams, Windows device protection with MDM, repository/container labels, and new Zen API endpoints. • Every AI pentest & code audit now ships a diagram of your app's architecture, roles, and trust boundaries • Device Protection is now available for Windows, with MDM support to roll it out across your fleet • Attach any metadata you want to repositories and container images (business unit, PII, region, ... ) and filter you issue feed based on those labels Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/48-ai-code-audit-aikido-mcp-and-servicenow-integration https://help.aikido.dev/changelog/q2-2026/48-ai-code-audit-aikido-mcp-and-servicenow-integration Tue, 02 Jun 2026 00:00:00 GMT New AI Code Audit engine, Aikido MCP integration, ServiceNow ticketing, and multiple API endpoints added in v48. • Adds `Aikido MCP` capability to search and fetch issues directly from an AI coding assistant • Adds `ServiceNow Integration` to connect ServiceNow as a task tracker for automatic ticket creation • Adds new API endpoints: `List Licenses`, `List Malware`, and `Get IDE/MCP usage statistics` • Adds Oracle Cloud support with +50 rules under the Cloud section • Adds Alibaba organization onboarding capability under the Cloud section • Adds GCP VM Scanning support Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security https://help.aikido.dev/changelog/q2-2026/new-code-audit-pentest-grade-reasoning-on-your-source-code-no-environment-required. https://help.aikido.dev/changelog/q2-2026/new-code-audit-pentest-grade-reasoning-on-your-source-code-no-environment-required. Tue, 26 May 2026 00:00:00 GMT Introduces 'Code Audit' feature using agentic reasoning to detect logic flaws in source code without requiring a live environment. • Adds `Code Audit` capability to find logic flaws like cross-tenant data leakage directly on connected repositories • Enables `AutoFix` for creating remediation PRs via the issue experience in the Code Audit workflow • Pricing for Code Audit is exposed upfront in credits before starting an audit Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aikido-security