Top all-time · #4678
Endor Labs
Company blog · endorlabs.com/blogsecurityai
Endor Labs is the company blog at endorlabs.com, writing about security and ai. Since 2022, 17 different Hacker News readers have linked it 30 times, most often “AI Coding Agent Security Benchmark”. It is still writing: the last post was on 2026-10-31, and you can follow it by feed.
Too few sampled comments (11) to say how often HN recommends it.?
Why HN links it
HN readers link Endor Labs' security research posts: npm and PyPI supply-chain attacks, a critical Apache Parquet RCE, a Protobuf flaw, and AI code security benchmarks. Commenters cite them as sources and details.
Summarised by Claude from a sample of 11 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Endor Labs is an application security platform built for AI-generated and human-written code, helping teams prioritize and fix real risk across the SDLC.
Most-linked posts?
- AI Coding Agent Security Benchmark4 people · 6 mentions · first linked 2026-04-15
- Critical RCE Vulnerability in Apache Parquet/CVE-2025-300652 people · 4 mentions · first linked 2025-04-03
What Hacker News says?
While GitHub needs to invest in finer grained permissioning, I do think there’s lots of lessons for companies building with and customers using GitHub App based deployments. Jotted down my thoughts here https://www.endorlabs.com/learn/when-coderabbit-became-pwned...
Comment linking /learn/when-coderabbit-became-pwnedrabbit-a-cautionary-tale-for-every-github-app-vendor-and-their-customers
on “How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos”Submitted Mastra compromised in supply chain attack as a story · 3 points
HN discussionhttps://www.endorlabs.com/learn/critical-rce-vulnerability-i... > Any application or service using Apache Parquet Java library versions 1.15.0 or earlier is believed to be vulnerable (our own data indicates that this was introduced in version 1.8.0; however, current guidance is to review all historical versions). This includes systems that read or import Parquet files using popular big-data frameworks (e.g. Hadoop,…
Comment linking /learn/critical-rce-vulnerability-in-apache-parquet-cve-2025-30065---advisory-and-analysis
on “Max severity RCE flaw discovered in widely used Apache Parquet”Submitted Eslint-config-prettier Compromise as a story · 3 points
HN discussionOriginal source: https://www.endorlabs.com/learn/critical-rce-vulnerability-i...
Comment linking /learn/critical-rce-vulnerability-in-apache-parquet-cve-2025-30065---advisory-and-analysis
on “Max severity RCE flaw discovered in widely used Apache Parquet”Submitted Critical RCE Vulnerability in Apache Parquet/CVE-2025-30065 as a story · 3 points
HN discussionCompelled speech is unconstitutional. Forcing someone to use SI instead of AI is like forcing someone to use pronouns. And this is not superintelligence: https://www.endorlabs.com/research/ai-code-security-benchmar... . Calling it superintelligence is false.
Comment linking /research/ai-code-security-benchmark
on “US President says he will ban the term 'artificial intelligence'”Submitted 22x memory amp DoS in Anthropic's buffa protobuf decoder (CVE-2026-55407) as a story · 2 points
HN discussionIf harnesses are basically doing nothing, why would these metrics vary so widely? https://www.endorlabs.com/research/ai-code-security-benchmar... There's a lot of ways to configure agents and any implicit configuration to harnesses may have a non-trivial effect.
Comment linking /research/ai-code-security-benchmark
on “MiMo Code Is Now Released and Open-Source”Submitted Claude Fable 5: mid-tier results on coding tasks as a story · 2 points
HN discussion> I found my interactions with Fable to be extremely impressive; it made other models, including GPT 5.5 and Opus 4.8, feel small and dumb. > Anthropic models have consistently been top-scoring in BullshitBench[0] eyeroll I find that Anthropic models feel big and dumber. https://www.endorlabs.com/research/ai-code-security-benchmar... puts Fable 5th, which seems about right to me. I'm interested in code utility and c…
Comment linking /research/ai-code-security-benchmark
on “Anthropic's Safety Superpower”Submitted CVE-2026-22709: Critical Sandbox Escape in Vm2 Enables Arbitrary Code Execution as a story · 2 points
HN discussionRelated: Analyzing a NPM Spam Campaign: The Great Indonesian Tea Theft https://www.endorlabs.com/learn/the-great-indonesian-tea-the... ( https://news.ycombinator.com/item?id=45919514 )
Comment linking /learn/the-great-indonesian-tea-theft-analyzing-a-npm-spam-campaign
on “Crims Poison 150K+ NPM Packages with Token-Farming Malware”Submitted Analyzing a NPM Spam Campaign: The Great Indonesian Tea Theft as a story · 2 points
HN discussionLots more details from Endor labs (flaw finder & source): https://www.endorlabs.com/learn/the-dangers-of-reusing-proto...
Comment linking /learn/the-dangers-of-reusing-protobuf-definitions-critical-code-execution-in-protobuf-js-ghsa-xq3m-2v4x-88gg
on “Critical flaw in Protobuf library enables JavaScript code execution”Submitted Critical RCE Vulnerability in Apache Parquet/CVE-2025-30065 as a story · 2 points
HN discussion> Why is the LiteLLM incident on there? The linked article for that one is a 404. -> [Endor Labs] https://www.endorlabs.com/learn/teampcp-isnt-done -> On March 24, 2026, Endor Labs identified that litellm versions 1.82.7 and 1.82.8 on PyPI contain malicious code not present in the upstream GitHub repository. litellm is a widely used open source library with over 95 million month downloads. It lets developers route r…
Comment linking /learn/teampcp-isnt-done
on “The "Vibe Coding" Wall of Shame”Submitted How to quickly measure SBOM accuracy for Maven projects using sbom-lab as a story · 2 points
HN discussionActually its average because it's 5th on the leaderboard. GPT 5.5 and Opus 4.8 outperformed it. At 5-8x the cost, you would expect better! https://www.endorlabs.com/research/ai-code-security-benchmar...
Comment linking /research/ai-code-security-benchmark
on “Claude Fable 5: mid-tier results on coding tasks”Submitted AI Coding Agent Security Benchmark as a story · 1 points
HN discussionSource: https://www.endorlabs.com/learn/the-great-indonesian-tea-the...
Comment linking /learn/the-great-indonesian-tea-theft-analyzing-a-npm-spam-campaign
on “Fake packages flood NPM registry in major attack – here's what we know”Submitted Type Confusion Vulnerability in isolated-VM as a story · 1 points
HN discussionSubmitted Hacking your life with AI can get you hacked – Research as a story · 1 points
HN discussionSubmitted Please add min-release-age to your .npmrc as a story · 1 points
HN discussionSubmitted Claude Fable 5: The harness matters more than the model as a story · 1 points
HN discussionSubmitted The Dangers of Reusing Protobuf Definitions: Critical Code Exec in Protobuf.js as a story · 1 points
HN discussionSubmitted AI Coding Agents get better at functional code, but not security as a story · 1 points
HN discussionSubmitted How to Defend Against NPM Software Supply Chain Attacks as a story · 1 points
HN discussionSubmitted Selection based on OSS package scores as a story · 1 points
HN discussionSubmitted Endor Labs Software Supply Chain Security as a story · 1 points
HN discussion
