Semgrep

Is GLM 5.2 backdoored? How would we know? With models like GLM 5.2 performing at Opus-quality on some tasks, this question becomes more important. We've historically used reverse engineering to establish ground truth about program behavior, but there is no equivalent for that today with the models. I wrote about the abysmal state of the model supply chain with @InsiderPhD and @spacerog : semgrep.dev/blog/2026/ai-s…

ICYMI: Last week, our @semgrep internal benchmarks showed that for the first time, an open-source model (GLM 5.2) matched frontier model performance in a vulnerability finding class. This is a big deal for policymakers (and hopefully we had a small part in getting the Fable-ban lifted!) H/T to Bob MicMillan at the WSJ for the great coverage! wsj.com/tech/ai/chines…

If you're walking the Business Hall, come find us at Booth #4943 for a real demo, not a pitch. And catch Drew Dennison's "Using SAST + Mythos To Shift Right," Thu Aug 6, 3:15pm, Pulse Stage 4 (Expo pass works).

The Business Hall: It's intense but you never know what some vendors will do with the space, from booth talks, to unique swag, to live demos, there's nothing quite like it, you'll find hilariously creative booths, and be wowed by the best tech.

Black Hat USA is back at Mandalay Bay, Aug 1–6. 100+ briefings, 100+ trainings, 80+ Arsenal demos. The hard part isn't finding something good. It's choosing what to skip. But how can you spend the week well? Don't worry we have some ideas!

What is the Cyber Resilience Act, and what does it actually require? Our Security Advocate, Dr. Katie Paxton-Fear (@insiderPhd), has all the details 👇

Rule one: prioritize original research over marketing. The talks people still cite years later are the ones where someone spent months breaking a system and found something new.

We analyzed anonymized remediation patterns across 50,000 active repositories, and the data revealed a clear pattern: Past 90 days, security findings stop being just risks and start becoming research projects. The longer an issue sits, the less likely it is to ever get resolved. Why? Because code authorship gets murky, the surrounding code shifts, and finding a fix becomes an archaeological dig just to surface the original context. That "dig" can take just as long as the original sprint took to build the capability to begin with. Beyond that critical 90 days, the success rate for resolving security issues hits a steep drop-off. Leading teams resolve issues under this threshold, while the rest of the field gets bogged. To maximize your team's efficiency, follow the lead of top-performing AppSec teams: hold the line and prioritize freshly identified findings.

Have you heard about the European Cyber Resilience Act (CRA)? If you are a Semgrep customer, you are already checking off a lot of the boxes. Semgrep helps you ensure seamless CRA compliance without losing velocity Our Security Advocate Dr. Katie Paxton-Fear explains how 👇

T-minus five weeks to Hacker Summer Camp. The annual convergence of BSides LV (Aug 3), Black Hat (Aug 5–6) and DEF CON 34 (Aug 6–9). Three venues, one week, the highest density of interesting vulns people and talks on the calendar. Sleep schedules are a known acceptable loss.

WOW @owasp Global AppSec EU was fantastic this year – even bigger & better than ever before! 🇦🇹 The team had a brilliant few days in Vienna, meeting many friendly faces & new ones alike – for great conversations, interesting insights, and a fun time together as a security community. Securing AI generated code, using LLMs to enhance detection, and complying with CRA were top of mind at the conference – with Vienna views and Austrian food the stars of the show after hours, as 100+ AppSec pros touched the sky at our elevated evening event! ⬆️ Thanks to everyone we chatted to across the two days, plus our partners @code_armor and @escapetechHQ for all their support. See you in 2027 🥳

Black Hat USA 2026: A Space Rogue Survival Guide Forget the vendor swag and AI buzzword bingo. I dug through the schedule and shared what research and sessions I wouldn't miss. See you in Vegas. semgrep.dev/blog/2026/blac…

Here's our other coverage from Miasma v2 when it used the same binding.gyp technique to run the malware semgrep.dev/blog/2026/mias…

We've pushed rules to our supply chain customers, but this is another sign that the changes coming in npm v12 aren't coming soon enough.. semgrep.dev/orgs/-/advisor…

Miasma is back, 20 npm packages for the Leo Platform ecosystem were infected with another worm. Payload is a CI/CD attack toolkit that steals secrets from GitHub Actions runners, cloud creds stores, package registries, and password managers, then exiles them to Github

The old gate was human review. But when agents ship code faster than any human can review it, it can't keep up. Most teams now see ~10x the vulns they had two years ago, and CI/CD catches them too late. So where's the gate now? We are launching Semgrep Guardian, it scans every file the agent touches, as it's written. 95% of scans finish under 5s and it's available now in Cursor + Claude Code