Snyk: Product Launch

The leadership read

Snyk's ToxicSkills research did something most threat intelligence work does not: it exposed a detection category that the entire security toolchain lacks, not a vulnerability in a specific product. The 76 malicious payloads found in ClawHub and skills.sh were not caught by any mainstream scanner because SAST and SCA have no semantic layer, they inspect code and dependency versions, not natural-language instruction sets that execute like code. By publishing this research, Snyk has formally committed to agent-layer security as a product and research domain, which is a materially different position than developer-facing vulnerability scanning. The related signals set for this period is dominated by product launches across unrelated verticals, which makes direct comparables thin. That said, Armory Defense's launch of Offensive Agentic-AI Simulations and Cisco's April announcement of an AI Agent Security Scanner for IDEs both point toward the same structural gap Snyk is now documenting. This is a category-formation moment: multiple vendors are simultaneously publishing research and tooling into a threat surface, agent skill definitions, MCP tool descriptions, SKILL.md artifacts; that had no named detection discipline eighteen months ago. Companies operating at the intersection of developer tooling, AI agents, and enterprise security face rising demand for leadership in security research, product-led detection engineering, and the kind of policy and standards work required when a new threat category lacks both regulatory framing and vendor consensus. The market is moving toward operators who can translate offensive research findings into defensible detection products at speed.