Endor Labs adds buildless C support to AI SAST tool

Endor Labs has added full C support to its AI SAST security testing product, bringing buildless static analysis to a programming language that has long been difficult for such tools to assess.

The update extends Endor Labs' AI-assisted static application security testing to C, which is widely used in embedded systems and other low-level software where memory handling errors and integer issues remain common sources of vulnerabilities.

Its C analysis runs without requiring a software build, allowing scans inside an integrated development environment and on pull requests. The aim is to move testing earlier in the software development process rather than relying on checks at the release stage.

In tests across four embedded C projects in one customer codebase, the company said it found 96 of 102 known vulnerabilities. According to Endor Labs, that result was 48 times higher than the next-best buildless pattern-based SAST tool in the same test.

Buildless testing

Static analysis in C has often challenged security tools because of features such as macros, conditional compilation, pointers and project-specific memory handling conventions. Traditional scanners that depend on builds and compiler hooks can struggle to reproduce exactly what developers wrote across different configurations, while lighter buildless tools can miss flaws or generate high numbers of false positives.

Endor Labs said its system analyses C source code directly rather than relying on compiler output. It combines deterministic program analysis with large language model reasoning, using code structure and data flow information to examine how values move through functions and files.

The company said this approach helps it address vulnerabilities that span multiple functions rather than matching narrow source-to-sink patterns. It cited buffer overflows, use-after-free flaws and integer overflows affecting allocation sizes as examples of issues that can be difficult for conventional pattern-based scanners to identify accurately.

Each finding includes a call path, an exploit and a suggested fix, according to Endor Labs. The product is designed to let developers review AI-generated or manually written C code before it reaches production branches.

Wider benchmark

Endor Labs also pointed to earlier testing of its AI SAST product across eight public projects in Java, Python, JavaScript, TypeScript, C#, Go and other languages. In that benchmark, the company said the tool found 192 real vulnerabilities, more than double the number found by any other tool it compared against, including traditional SAST products and frontier AI models.

That earlier testing showed the product identified 64 of 106 CWE types in the benchmark set and found 63 vulnerabilities that no other tool detected, according to the company. Endor Labs framed the C launch as an extension of the same analysis model into a language with a more complex static analysis profile.

Open source findings

Beyond customer codebases, Endor Labs said its C analysis has uncovered zero-day vulnerabilities in popular open source C projects. It said it is working through responsible disclosure processes and has not released further details on those findings.

The launch comes as software vendors and security teams adjust to a development environment increasingly shaped by code-generation tools. Endor Labs argued that AI assistants are increasing the volume of C code being written while also reproducing established classes of flaws faster than human review can keep up.

That dynamic is particularly relevant in older C codebases, where teams may be maintaining software written years earlier under coding practices that no longer meet current security expectations. In such settings, buildless scanning during day-to-day development could appeal to teams trying to reduce delays tied to release-gated review.

Endor Labs added that its C SAST offering works alongside its software composition analysis for C on the same platform, covering both in-house code and the open source components it depends on.

The product was built for code reviewed while the pull request is still open, the company said.