Neutron, our AI engine, scored 97.1% on UC Berkeley's CyberGym benchmark. Learn more

Blog

Ostorlab Blog

Vulnerability research, CVE deep dives and engineering write-ups from the Ostorlab team on AI pentesting and mobile, web and API security testing.

Featured Stories See all articles →

Security

Can an AI Agent Prove SAST Findings at Runtime?

Static analysis flags possible bugs but cannot prove them. Runtime validation proved a Langflow authenticated RCE and corrected a libxml2 use-after-free's stated trigger conditions.

Mohammed Lachhab
Sep 23, 2026

Security

The Map and the Window: How an Agentic Scan Chained a Documentation Leak Into Stolen Credentials

See how Ostorlab's Agentic Deep Scan chained a Medium-severity OpenAPI disclosure and an SSRF vul...

Sep 23, 2026

Security

Best API Security Testing Tools in 2026: 4 Compared

The best API security testing tools in 2026: StackHawk, 42Crunch, Escape, and Ostorlab compared o...

Sep 22, 2026

Security

Post-Mortem: Why Autonomous AI Agents Escape Scope and How to Contain Them

A technical post-mortem on an AI agent that wandered outside its testing scope during an authoriz...

Sep 18, 2026

Read by Topic

Latest from Engineering, Product & Security
Engineering
View all Engineering →

The True Cost of False Positives: Calculating the Engineering Tax of Noisy Scanners

False positives are an engineering-capacity problem, not only a scanner-quality problem. Learn how to measu...

Sep 28, 2026

When Does an AI Scanner Become an AI Pentest?

Learn what separates AI-powered scanning from AI pentesting and how Ostorlab Deep Agentic Scan follows evid...

Jul 22, 2026

Source Code Security: From Signal to Validated Risk | Ostorlab

Learn how source code security testing works, why traditional SAST creates false positives, and how agentic...

Jul 16, 2026
Product
View all Product →

How Ostorlab Detects LLM Vulnerabilities

See how Ostorlab detects LLM vulnerabilities through banking chatbot examples of private statement leaks, u...

Oct 23, 2026

Snyk and Checkmarx Alternatives: Ostorlab vs Snyk Code, Checkmarx One and GitHub Advanced Security (2026)

The best Snyk Code, Checkmarx One and GitHub Advanced Security alternatives for SAST in 2026, and how Ostor...

Oct 07, 2026

We Built an AI Agent for Our Own Backlog. Now It's Yours.

How a small agent that turned bug tickets into pull requests became Ostorlab's ticket agent: an AI teammate...

Oct 06, 2026
Security
View all Security →

Ostorlab vs MobSF: Analyst-Driven vs AI-Driven Mobile Security Testing (2026)

Ostorlab vs MobSF (Mobile Security Framework) for mobile app security testing: static and dynamic analysis,...

Oct 07, 2026

Ostorlab vs Oversecured: Mobile App Security Testing Compared (2026)

Ostorlab vs Oversecured for mobile app security testing: iOS and Android coverage, exploit proof, authentic...

Oct 07, 2026

Ostorlab vs. Pentesting Firms: 2026 Cost & Depth Comparison

Ostorlab vs. pentesting firms: cost, testing frequency, depth and remediation, and when to use AI pentests,...

Sep 25, 2026

Changelog

View all changes

October 2026: From Security Findings to Tested Fixes

 Oct 17, 2026

New Dashboard UI, On-Premises Scanner, Agentic Scan Knowledge, Multi-Asset Scanning, Linear & MCP Integrations, and New Model Support

 Sep 02, 2026

App Vetting, Scan Coverage Heatmap, Mobile Shielding Scan, Deep Agentic Scan Improvements, Cyber Models & Source Code Scanning

 Jul 07, 2026

Single Vulnerability Assessment (SVA), Dig Deeper, Scan Report PDF Design Improvement & Multilanguage Support

 Jun 01, 2026