#56 - Cloud Asset Map, Creating fix PRs with Deep Review and Code Coverage on GitLab

22 Sep 2026

Features

• Cloud Inventory - See every cloud resource laid out by region and VPC, with exposure findings and firewall rules one click away. No more hopping between hundreds of console screens to know what's running and what's exposed.
• Creating fix PRs with Deep Review - Reply to a Deep Review comment asking for a fix, and Aikido opens a new pull request with the fix, built on your current PR.
• Code Coverage on GitLab - Upload coverage from GitLab CI and see per-file, per-line results in Aikido, alongside GitHub.

Aikido Intel - Malware & Vulnerability Database

Our research team has discovered over #501 new vulnerabilities over the last two weeks!

Aikido launched Altar, its first open-weight security model, built to run frontier-grade pentesting fully on-prem and air-gapped without sending sensitive data to a third party.

Aikido researchers also found a second camouflaged RCE in MECCHA CHAMELEON, where a malicious custom map could write an executable to a user's startup folder.

Improvements

• Device Protection

  • Automatic bypass of min package age for packages with critical CVE’s and free of malware
  • New ecosystems: Firefox and Homebrew
• Pentest

  • Access for team only users which retesting issues
  • Added Sensitive Data information to DSPM
  • New Infrastructure focussed checks added
• Code Quality - Create Task Trackers issues for quality findings
• Container scanning - Reachability now includes BigQuery datasets
• Cloud - VM Reachability now available for GCP
• MCP - New tools:

  • Get issue details including pentest information, deep review, and other
  • SCA scanning tool
• Custom reports - Support grouped bar charts
• Zen Firewall - Agent releases for Java, PHP, Golang and Node

  • Added Alpine support for PHP
• IDE - New release for Jetbrains: Added support for multi repository scanning
• API - List user logins history
• API - Broker management
• API - Webhook when new issue ignore/snooze request accepted or denied
• API - Webhook for Domain scan finished