Semgrep
PulseAugur coverage of Semgrep — every cluster mentioning Semgrep across labs, papers, and developer communities, ranked by signal.
10 day(s) with sentiment data
-
Replit integrates Semgrep Guardian for AI code security
Replit has integrated Semgrep Guardian's secrets detection directly into its AI development platform. This integration aims to enhance the security of applications built by Replit's millions of developers, particularly …
-
Sentinel review score to add external factors including GitHub and npm metrics
The Sentinel review score, used to assess software components, currently relies solely on internal factors such as metadata checks, static analysis, and malware pattern matching. However, the system plans to incorporate…
-
New tool mcp-tenant-isolation targets cross-tenant data leaks
A new static analysis tool, mcp-tenant-isolation, has been developed to address critical cross-tenant data leakage vulnerabilities in multi-tenant SaaS applications and MCP servers. Unlike traditional security scanners …
-
AI vulnerability scanner achieves 7% recall in initial OWASP Benchmark test
An AI vulnerability scanner, designed to use deterministic static-analysis rules combined with an LLM for false-alarm judgment, initially achieved a recall of only 7% on the OWASP Benchmark. This low recall indicated th…
-
Replit integrates Semgrep security scans into its AI development platform
Replit has integrated Semgrep's security scanning capabilities directly into its development platform, allowing scans to run automatically during the build process. This feature, part of Replit's Auto-Protect suite, aim…
-
OWASP Boston August meetup discusses AI ethics and security
The OWASP Boston chapter has published its August meetup, which featured a talk by Mardiros Merdinian on the ethics of AI and its implications for security. Semgrep sponsored the event.
-
Semgrep blog compares open-source AI code security tools
A blog post from Semgrep compares various open-source AI code security harnesses, highlighting emerging approaches in the field. The post aims to provide insights into different methods for securing AI codebases.
-
New tool integrates multiple Python code quality analyzers for AI agents
A Reddit user shared a tool that integrates multiple Python code quality and security analysis tools into a single platform. This aims to improve the quality of code generated by AI agents, allowing human developers to …
-
Security audit finds only 6 MCP servers perfectly secure
Edison Flores of AliceLabs LLC conducted a security audit of 8,845 MCP servers, utilizing a 9-layer pipeline named Sentinel. The audit revealed that only six official Anthropic reference servers achieved a perfect secur…
-
Researcher poisons open-weight AI model for under $100
A cybersecurity researcher has demonstrated how to poison an open-weight AI model for less than $100. Katie Paxton-Fear, a lecturer at Manchester Metropolitan University, was able to install a backdoor in a model within…
-
AI model supply chain risks are decades old, not new discoveries
A recent essay highlighted the significant risks associated with AI model supply chains, drawing parallels to Ken Thompson's 1984 "Reflections on Trusting Trust" to illustrate the difficulty of auditing complex systems.…
-
GLM-5.2 raises cybersecurity concerns amid open-source accessibility
The open-source AI model GLM-5.2 is raising cybersecurity concerns due to its accessibility and lack of a mediating vendor. Security firms have noted its proficiency in identifying software bugs and performing cybersecu…
-
AI Agent Infrastructure Rife with Critical Security Vulnerabilities
A security audit of 50 popular Model Context Protocol (MCP) servers found critical vulnerabilities in 40 of them. The issues included command injection in an orchestration tool, memory safety bugs in a C project, path t…
-
Security checklist proposed for exposing LLM MCP servers
Exposing Machine Completion Protocol (MCP) servers to Large Language Models (LLMs) introduces significant security risks due to their ability to interact with real-world systems. A six-point security checklist is propos…
-
Semgrep's GLM-5.2 outperforms Claude in cybersecurity benchmarks
Semgrep has released benchmark results indicating that their GLM-5.2 model outperforms Anthropic's Claude in cybersecurity-related tasks. The comparison, framed as "Mythos at Home," highlights GLM-5.2's capabilities in …
-
China's GLM-5.2 AI model lowers barrier for advanced cyberattacks
China's new open-source AI model, GLM-5.2, is raising concerns among security researchers about the increasing accessibility of advanced AI hacking capabilities. Released by Z.ai, GLM-5.2 reportedly rivals models like C…
-
Developer's code security tool finds critical flaw in its own dependencies
A developer building a code security analyzer named vibeanalyzer discovered a critical vulnerability in their own tool's dependencies using Semgrep. The vulnerability, a path traversal in the vitest dependency, could al…
-
LLMs outperform static analysis tools in code security review
A recent benchmark comparing traditional static analysis tools with large language models for application code security review revealed that LLMs like GPT-4.1, Mistral Large, and DeepSeek V3 significantly outperform too…
-
Semgrep launches Pyro Caml, OCaml's first continuous profiler
Semgrep has released Pyro Caml, a new continuous profiling tool for the OCaml programming language. This tool is designed to run in production environments, continuously monitoring program performance and sending data t…
-
Shai-Hulud malware infects PyTorch Lightning AI training library
A supply chain attack has compromised the PyTorch Lightning AI training library, affecting versions 2.6.2 and 2.6.3. The malicious code, themed after "Shai-Hulud" from Dune, executes automatically upon import and steals…