Security scanning just moved inside the agent session. stackhawk's wingman, out september 15,…
security scanning just moved inside the agent session. stackhawk's wingman, out september 15, installs into claude code, cursor and copilot and fixes the vulnerability while the agent is still writing code.
the fix lands before the commit does.
Context
StackHawk's blog and press release of September 15, 2026 announce Wingman as broadly available. They name Claude Code, Cursor, GitHub Copilot, Codex and Antigravity. When the agent finishes a feature, Wingman auto-configures and boots the running app, tests it, passes findings to the same agent, rescans to confirm, and reports to CI before the pull request opens. Pricing is $10 per user per month with unlimited applications and 50 scans per user per month, and a 14-day free trial. The docs, a current window, say it needs a StackHawk account, the hawk CLI v6.0.0 or later, and an app running locally that the scanner can reach.
The scan runs when a feature is marked done and before the pull request opens, not before the commit and not while the agent is still writing. Five agents are named and the note lists three. StackHawk's figures, more than 7,500 vulnerabilities fixed for early-access customers and 98% remaining resolved, are its own with no method beyond the dates June through September 13. The only product that finds, fixes and verifies inside the agent loop is a vendor superlative and unverified. The docs are current documentation. Security scanning just moved inside the agent session is the author's framing.
Related work
- The security scanner now sits inside the coding loop ↗An earlier note on the same launch.
Watch next
- Independent results on the fix rate.
Sources
- StackHawk blog: Wingman broadly available (September 15, 2026)stackhawk.com
- StackHawk press release (September 15, 2026)prnewswire.com
- StackHawk docs: agent skillsdocs.stackhawk.com
Provenance
The note above is reproduced unedited from the original post, first published on Threads on 22 September 2026 at 10:17 IST. Sources are the papers and datasets the note draws on.
View the original post ↗Embed this note
More notes
The air is now being asked to keep its own ledger
the air is now being asked to keep its own ledger: ecmwf’s aifs compo becomes the first ai model to forecast atmospheric composition globally every three hours, cleanair simulates 365 days of pm2.5 over china in ten seconds, and a unified framework maps six pollutants at one kilometer across the whole country. the air now files its own composition report.
read the note →The current is now being asked to draw its own map
the current is now being asked to draw its own map: china’s langya 2.0 predicts six ocean phenomena including internal waves and mesoscale eddies, a deep net called wenhai resolves eddies globally with air sea flux formulas built in, and scripps infers surface currents from the way temperature patterns deform in satellite images. the ocean now files its own circulation report.
read the note →The soil is now being asked to report its own carbon
the soil is now being asked to report its own carbon: a nix color sensor paired with generative data augmentation predicts soil organic carbon without a lab, random forest drives 74 percent of soil health mapping studies, and sentinel 2 tracks five year carbon change across france and italy from 922 samples. the dirt now files its own carbon account.
read the note →