Endor Labs Launches Free AI Code Security Tool as Only 10% of AI Output Passes Security
The Development
Endor Labs launched AURI on March 3, 2026, a free AI code security platform that embeds real-time vulnerability intelligence directly into AI coding assistants including Cursor, Claude, and Augment via the Model Context Protocol. The launch is underwritten by $208 million in total venture funding, including a $93 million Series B closed in April 2025. The urgency is backed by hard data: research from Carnegie Mellon, Columbia, and Johns Hopkins found that while leading AI models produce functionally correct code 61% of the time, only 10% of that output is both functional and secure. AURI's core differentiator is a function-level code context graph that traces exactly how dependencies are used in an application, enabling full-stack reachability analysis that Endor Labs says reduces security findings by 80–95%. The free tier runs entirely on-device, requires no sign-up, and is available in VS Code, Cursor, and Windsurf. Enterprise tiers add policy controls, CI/CD integration, and team-scale role management.
Our Take
The 10% statistic is the number that should be stapled to every CTO's monitor right now. Marketing and product teams pushing for faster AI-assisted development are inadvertently building technical debt with a security fuse attached. What Endor Labs understands—and most of the market hasn't fully priced in—is that the AI coding explosion has created a separation-of-duties vacuum. Anthropic building security review into Claude is not a solution; it's the same author grading their own exam. AURI's three-principle framework—independence, reproducibility, verifiability—is a direct argument against purely LLM-based security review, and it's a compelling one for any enterprise operating under FedRAMP, NIST, or the EU Cyber Resilience Act. The freemium playbook targeting individual developers before procurement is textbook GitHub-style bottom-up distribution. The real question is how fast Endor Labs can convert developer installs into enterprise contracts before the AI coding platforms build security deeper into their own native tooling.
The Exploit
Action Item
If your team is using AI coding assistants in any production workflow, deploy AURI's free MCP tier to your developers this week before your next sprint cycle ships code that your security team will spend Q2 unwinding.