Coding agents running on Kura prevented 94% of business-logic vulnerabilities, versus no more than 37% for the frontier labs, using a fraction of the security context.

NEW YORK CITY, NY / ACCESS Newswire / August 3, 2026 / Clover Security, the secure-by-design platform for agentic software, today launched Kura: Adaptive Security Context for coding agents and released the research behind it. Building a real feature in multiple production codebases, coding agents leveraging Kura prevented 94% of the business-logic vulnerabilities hidden in the spec. The same frontier models, armed with the general security context most teams rely on today, only managed to prevent 37%, performing better than a model given no security context at all, but with a counterproductive side effect: it inflated the agents' security confidence and vocabulary, so they produced security-aware plans and passing tests while the vulnerability shipped underneath.

AI now writes a growing share of production code, and it writes insecure code. The assumption is that more security context yields safer code. Clover's research shows the opposite: broad security context does not make code safer. It made it look safer, raising agents' security vocabulary and confidence so output reads as secure while the vulnerability is still there.

"The prevailing expectation in the field is that more security context will help agents deliver secure code. Instead it only teaches agents to sound secure while shipping the same vulnerabilities," says Alon Kollmann, CEO and co-founder of Clover Security. "Secure code in the agentic era is not gated by the model. It is gated by whether you can dynamically pinpoint the security context each agent needs. That context is a moving target, and it moves at agentic speed."

Kura takes the less-is-more approach. It runs on Clover's continuous threat-modeling harness, which keeps a live threat model of the application as its design, architecture, and code change. From that, Kura spawns a threat model scoped to the single task a coding agent is about to take on, then hands the agent the specific threats for the feature being built and the concrete countermeasures for each, and nothing beyond that. It connects to the coding agents teams already use in one click and works inside their workflow, applying that context as the code is generated instead of flagging it in a review after the fact.

Producing that right context accurately and keeping it current, at the speed agents write code, is the harder problem Clover is built to solve. The results behind Clover's research are not limited to open source projects either. Existing Clover enterprise customers running on Kura these past few months have seen the same results consistently.

The research is available on the Clover Security blog at https://clover.security/resources/.

About Clover Security

Clover Security is the secure-by-design platform for agentic software. Its AI agents plug into the tools product security teams already use, enabling secure design, secure agentic development, and continuous validation, without slowing builders down. Clover is headquartered in New York and serves enterprise customers including ServiceNow, Expedia, Plaid, Notion, and Virgin Money. Clover is backed by Notable Capital, Team8, ServiceNow, and SVCI. Learn more at www.clover.security.

Media Contact
Mia Balaban
mia@tellny.com

SOURCE: Clover