We are excited to introduce Dependency Firewall with On-Device Protection. It enforces security policies on devices and blocks malicious or untrusted packages across AI agents, applications, package managers, and registries. Centrally managed without changing how employees use their tools. Thread on supply chain attacks, how agents make this harder,... and what device mode enables:show more

Recent supply chain attacks have shown how quickly compromised packages can steal credentials, execute malware, and spread across company environments.

Incidents involving Shai-Hulud, Axios, Trivy, keyv, and other packages have exposed the growing risk inside the software companies already download and run. AI agents create more opportunities for compromised packages to reach company devices.

Tools like Codex, Claude Code, and Cursor routinely download and run third party software while completing tasks. This activity is also spreading beyond engineering as more teams use agents to analyze data, prepare documents, and automate work.

During our testing, agents often responded to blocked package installations by trying another path. They switched package managers, returned to public registries, changed local settings, or downloaded packages directly.

Device Mode enforces package security policies on the device. It blocks malicious or untrusted packages across AI agents, applications, package managers, and registry configurations. Policies can be managed centrally without changing how employees use their tools. Read more:

Enforcing at the device is the right layer, and the agent specific failure sits slightly upstream of malicious versus untrusted. Agents do not only install packages, they invent them. A model suggested import lands on a name that looks plausible and does not exist, attackers register those names in advance, and the thing that gets installed is brand new, has no bad reputation and no history to score. A policy built on known bad passes it cleanly, because the name originated in a model rather than in a registry. Which points at allowlisting against a resolved manifest rather than reputation, plus a rule that any dependency absent from the lockfile is a human decision rather than a lookup. Package age and adoption are weak signals, but they have the one property that matters here: the attacker does not control them on a package they published yesterday.

Supply chain attacks have been the #1 most impactful and destructive cybercrime this year. This is the permanent solution to this problem

we must allow users to pace the package frontier

Excited to get this in the hands of more customers

While keep patching/detecting malware in their code base, customers can now directly reject malware through the dependency firewall!

this is why agent security has to sit below the agent. a model can route around a blocked registry; it can't route around enforcement on exec. policy at the prompt layer is advice. policy at the device layer is a boundary

Having these types of guardrails in place is so important, especially as developer velocity continues to increase. Security should be proactive!

@grok compare it to the @SocketSecurity firewall product

How is this any different from Jfrog?