Agentic Development Security is a Discipline that Starts Before the First Line of Code

JFrog AI Catalog evolves into an AI control plane for the Agentic Development Lifecycle: models, skills, plugins, and MCP servers become native artifacts, so agents consume only approved AI assets.

JFrog previews swampUP 2026, where it will unveil its Trust Layer for the agentic software supply chain — immunization, self-healing, governance — amid 7.4x growth of malicious packages and AI assets.

JFrog's agentic repository Fly graduates into the main platform: agent ergonomics for Artifactory, semantic release metadata and AI-assisted workflows; the standalone beta is winding down.

JFrog introduces Agentic Software Supply Chain Security: AI agents via MCP vet packages with Curation and remediate CVEs inside GitHub Copilot, shifting teams from reactive to proactive protection.

GitLab's CISO argues detection is not defense as AI compresses exploit timelines. With 317 CVEs in 2026, the key metric is time from detection to verified remediation.

GitLab 19.4 expands the GitLab MCP server tool set so agents can run pipelines, open merge requests, and triage vulnerabilities, while writes, merges, and deletes still wait for a human reviewer.