Introducing Chainguard Checks: Reinventing Continuous Integration for the Agentic Era
By Chainguard
New approach to software development moves verification into the development loop, giving developers and AI agents trusted results in seconds, before code ever reaches a pull request
SEATTLE, Oct. 14, 2026 /PRNewswire/ -- Chainguard, the trusted source for open source, today announced Chainguard Checks, a new continuous verification engine optimized to bring continuous integration (CI) into agentic development loops, establishing trust as software is being written, rather than after it's been submitted. By transforming CI into something that can be used as a tool call that runs identically everywhere, Chainguard Checks gives developers and AI agents signed, trusted verification of their code in seconds, eliminating CI bottlenecks, slashing compute costs, and preventing supply chain risks before code ever reaches a pull request.
Waiting on CI is the new cost of AI development
AI agents are writing more code than ever, and CI has become the bottleneck. CI was built for developers who push code a few times a day. Agents iterate constantly, so every change lands in the same queue, and the faster they write code, the longer the queue gets. By the time results come back, the agent has lost the context it was working in, and teams are paying for the same setup work over and over. The root problem is where CI sits: outside the development loop, after the work is done. Security adds another layer of complexity. Runners typically combine long-lived secrets with untrusted code, so a single prompt-injected agent or malicious install script can steal static keys straight from memory. Chainguard Checks removes this friction while making CI more secure.
"Agents shouldn't just write code faster. They should be able to prove it works," said Dan Lorenc, CEO and Co-founder, Chainguard. "We built Checks because our own engineers work alongside thousands of AI agents, and traditional CI was the slowest and least secure part of how we build. Now verification happens while the agent is still working, and every passing run comes with signed proof that travels with the code."
Verification that happens where the work happens
Paired with the newly launched Chainguard Workspaces, an agent session suspends during check execution to halt compute consumption, then resumes in seconds with structured failure logs injected directly into its context to iterate until tests pass. Every passing run generates a signed attestation that travels with the code. Downstream merge gates can then verify attestation and merge the code immediately, without re-running the CI test suite, eliminating CI bottlenecks and saving compute spend.
Chainguard Checks includes:
- Warm snapshots: Every CI run starts from a warm snapshot with dependencies already installed. Snapshots are rebuilt whenever the lockfile changes, so the setup cost is paid once in the background instead of on every commit.
- Chainguard hardened, microVM execution environments: Each workflow step runs in its own hardware-isolated microVM environment built from zero-CVE Chainguard OS Packages, including FIPS-compliant toolchains, so untrusted code can't reach other workloads.
- No credentials to steal: Runners hold no long-lived credentials. A host-side proxy adds short-lived credentials to outbound requests in flight, and tools that need a credential on disk get an encrypted, short-lived stand-in.
- Network access by approval only: Declarative egress policies block connections to unapproved endpoints and can be configured to automatically deny requests or destroy the microVM to prevent data exfiltration and unauthorized network access.
- Signed attestations: Every run produces a signed attestation tying together the environment, test result, and commit.
- Merge without re-running: Merge gates can verify the passing attestation and merge without running tests again, eliminating queue time and redundant compute spend.
"Banks, fintechs, and corporates across Australia rely on Cuscal to move money safely. As we expand our digital payments infrastructure, giving engineers fast, secure workflows for AI adoption is a top priority. For CI, agents are exposing the flaws in traditional systems, from broken security models that give runners ambient access to secrets to inefficiencies like cold setups and delayed post-commit validation. We're excited to work hand-in-hand with Chainguard as an early design partner to shape the future of software development end-to-end," said Brad McCoy, Senior Manager, Cloud Platforms, Cuscal.
"Existing CI pipeline platforms and tools are struggling under the massive increase in load generated by agentic software development, leading to downtime, lost developer productivity, and unshipped code," James Governor, Analyst and Co-founder, RedMonk. "Chainguard Checks is designed to enable true shift left security and assurance, while also preventing CI from being a bottleneck."
Chainguard Checks is available now in Beta. For more information, visit chainguard.dev/checks.
About Chainguard
Chainguard is the trusted source for open source. By providing engineers and AI agents with hardened, trusted, and production-ready artifacts, Chainguard helps organizations prevent AI supply chain attacks, increase engineering velocity while reducing toil, and maintain continuous compliance. Customers include Fortune 500 enterprises and global industry leaders, including Anduril, Canva, DocuSign, OpenAI, Public Storage, Snap Inc., and Snowflake. Chainguard is venture-backed by leading investors, including Amplify, IVP, Kleiner Perkins, Lightspeed Venture Partners, Mantis VC, Redpoint Ventures, Sequoia Capital, and Spark Capital. For more information, visit: https://www.chainguard.dev/
Brittany Hendrickson, press@chainguard.dev
