Endor Labs CEO Warns AI Agents Propagate Software Vulnerabilities

Varun Badhwar, CEO and Co-Founder of Endor Labs, warns that AI coding agents are introducing critical security risks into enterprise software development. Benchmarking conducted by his team across hundreds of open-source tasks found that while AI-generated code frequently passes functional tests, only a small fraction of that code is actually secure.

Badhwar argues that these agents indiscriminately replicate insecure patterns found in public repositories, which accelerates the propagation of vulnerabilities at machine speed. He suggests that the rapid improvement in functional performance is outstripping the progress made in security performance.

To mitigate these risks, Badhwar proposes shifting security controls directly into developer workflows and prioritizing vulnerabilities based on reachability and exploitability instead of relying solely on severity scores. He further advocates for redefining success metrics for application security teams to prioritize automated orchestration of fixes and real-time risk reduction.