Publisher

chainguard.dev

About chainguard.dev on Clarity Today

Newest story built on chainguard.dev reporting: Chainguard's beta scanner returns malware verdicts on more than 5,000 Go and .NET packages (October 14, 2026). chainguard.dev reporting informs the Security and Product desks, most often on Software Supply Chain Security, Vulnerability Disclosure, and AI Vulnerability Discovery and Exploitation. 6 of our current stories draw on it, the earliest from September 15, 2026.

Current stories

securityConfirmed4 publishers

Over half of 1,300 surveyed security leaders admit their firms leave known high or critical flaws unpatched

Chainguard's 1,300-leader survey finds 66% at $1bn-plus firms knowingly leave high or critical flaws unpatched at least sometimes, versus 27% under $250m. The all-respondent rate is 54%, LeadDev reported, with testing and disruption the stated blockers.

Publishers:chainguard.dev infosecurity-magazine.com leaddev.com scworld.com

Perspective Coverage

4 publishers

Builder: Builder 34%
Operator: Operator 62%
Investor: Investor 4%

Reality

Evidence55
Adoption50
Hype gap+25
Incentives65
Confidence55

securityConfirmed2 publishers

Chainguard's beta scanner returns malware verdicts on more than 5,000 Go and .NET packages

Chainguard said its scanner returned malware verdicts on more than 5,000 Go and .NET packages during beta. More than 10% had no public match at detection, over 500 verdicts on the vendor's own count.

Publishers:chainguard.dev runtimewire.com

Reality

Evidence25
Adoption: Not scored
Hype gap+35
Incentives85
Confidence60

productConfirmed4 publishers

Chainguard sells frontier-model flaw hunting as a service its own staff run for customers

Chainguard unveiled Harness, which has frontier models such as Claude Mythos 5.1 attack a live build and reports only flaws that reproduce. It arrived with Workspaces and Checks for coding agents and an expansion of Libraries to Go and .NET.

Publishers:chainguard.dev helpnetsecurity.com siliconangle.com thenewstack.io

Perspective Coverage

4 publishers

Builder: Builder 32%
Operator: Operator 44%
Investor: Investor 24%

Reality

Evidence35
Adoption12
Hype gap+30
Incentives70
Confidence70

securityOne report1 publisher

Chainguard's Mythos harness finds a vLLM flaw that lets one client dictate another's output

Chainguard says its Mythos harness found a vLLM flaw, left in the public tracker for four months, that lets one client force another client's output. Versions before v0.31.0 are affected, and nothing is logged when the forced answer returns.

Publishers:chainguard.dev

Reality

Evidence58
Adoption: Not scored
Hype gap−5
Incentives65
Confidence60

securityOne report1 publisher

Chainguard discloses 14 Java bugs that were fixed upstream but never got a CVE

Chainguard disclosed 14 Java vulnerabilities that were fixed upstream but never assigned a CVE, one rated critical and one high. Teams still on the affected versions got no scanner alert, some for years, because nobody announced the fixes when they landed at HEAD.

Publishers:chainguard.dev

Reality

Evidence40
Adoption25
Hype gap+10
Incentives75
Confidence45

securityOne report1 publisher

Chainguard opens Athena's 40,000-finding backlog on September 28 with fifty silent fixes

Chainguard says fix generation was never its bottleneck and that responsible disclosure at scale is, so its first public batch is built from bugs upstreams quietly fixed years ago and never filed CVEs for.

Publishers:chainguard.dev

Reality

Evidence34
Adoption16
Hype gap+28
Incentives82
Confidence48