vibehacker
News
Endor Labs ·

Endor Labs Agent Security League: best coding agent writes secure code only 37.4% of the time

Endor Labs' public leaderboard, built on CMU's SusVibes (200 Python tasks across 77 CWE classes, with anti-cheating checks), tops out at Claude Code with Claude Fable 5.1: 87.2% of solutions work but only 37.4% also pass hidden security tests, ahead of Codex with GPT-6 Astra (34.6%) and GPT-6.1 Sol (34.1%). Across 32 agent and model combos, working code still mostly isn't safe code, so keep security review before merge.

Read at endorlabs.com
Claude Code
An AI coding agent for terminal, IDE, web, and Slack

More news

View all

Claude Code's sec-default mod now pins nine policy env vars so installed plugins can't change them

An Oct 11 rebuild of Claude Code's built in sec default mod blocks plugins outside policy from setting any managed settings variable plus nine always pinned names like CLAUDE CONFIG DIR , CLAUDE CODE MANAGED SETTINGS PATH , and USE LOCAL OAUTH , and treats plugins from git, GitHub, or npm marketplaces as user installed, never org vouched. With no managed settings at all, every variable counts as pinned; the change ships inside the binary after 2.1.296, so there's no version number to check yet…

MIXED

Claude Code dynamic workflows are generally available: tens to hundreds of parallel subagents

Dynamic workflows are now GA in Claude Code CLI, Desktop, and VS Code for Pro/Max/Team/Enterprise (plus Claude API, Bedrock, Vertex, and Foundry): Claude writes orchestration that fans work across parallel subagents, checks results before folding them in, and can resume interrupted runs. Start with “Create a workflow” or the ultracode effort setting; usage is much higher than a normal session, and admins can disable them in managed settings…

Anthropic Blog

ColGrep-Agent-2B: local 2B code-search agent cuts Claude Code tokens by 34%

LightOn released ColGrep Agent 2B, an open 2B local code search agent that sits between a coding agent and the repo; in their Claude Code tests on 52 questions across 13 repos, delegating search cut API tokens 34% and cache aware cost 40% vs grep, with no statistically significant accuracy change. Install with brew install lightonai/tap/colgrep && colgrep install agent , then colgrep install claude code (Codex and OpenCode hooks too)…

Hugging Face Blog (LightOn)

Codex raises GPT-6.1 Sol default context from 272K to 500K

OpenAI Codex lead Tibo raised GPT 6.1 Sol’s default context in Codex and ChatGPT Work from 272K to 500K tokens ( 80% more) to cut compactions on long tasks, with no long context fees on ChatGPT subscription usage. Override via model context window and model auto compact token limit in /.codex/config.toml ; the API max remains 1M…

AICoder

Codex CLI 0.157.0 starts a persistent self-updating app-server daemon by default

Opening an interactive Codex session on 0.157.0 now spins up a background app server that survives after the TUI exits, copies 374 MB of platform bits under /.codex , and runs an hourly updater that can force kill active turns after a 60s drain. Opt out with codex features disable daemon auto start , then codex app server daemon stop (and kill any leftover pid update loop )…

AppSec Scoop

Spotted something we missed? Start a thread.