Latest AI and tech news
Semgrep’s 2026 summer interns worked on four very different problems: backend autoscaling, Jira integrations, program analysis, and memory profiling. Along the way, they shipped real work, navigated the tradeoffs of production engineering, and lear...
Two decades of shift left never covered the thirty years of software already running in production. Here's what Semgrep's research team found pointing frontier models at it, and three things you can do this week....
Most malicious package versions get caught and pulled within hours or days. Most developers have little reason to use a dependency released that recently. A one week cooldown produces a surprisingly large security benefit with very little developer f...
Semgrep Multimodal found 63 manually reviewed IDOR vulnerabilities that Mythos missed....
Everyone is talking about Mythos-class capability. Nobody has defined it yet, so we put Mythos to the same benchmark as other frontier models, open-weight models and custom harnesses. Because "Mythos-class" has become an industry shorthand for a capa...
BSidesLV, Black Hat and DEF CON are infotainment at its finest, and there's far too much of it. We researched 2,295 talks across 2025 and 2026 to find what moves the needle in the AI stack....
Rust crates arrayref (244M downloads) and append-only-vec (4M downloads) were compromised with one added dependency line pointing to proc-macro1, a typosquat of proc-macro2. The malicious code sits in build.rs, which Cargo runs at build time, merely ...
GLM-5.3 just dropped and returns Opus 4.8-level performance for a fraction of the cost. Here’s how it and xAI’s recent Grok models compare in our benchmark....
Pinning GitHub Actions to commit SHAs is an effective supply chain defense, but annoying to do org-wide. Here's how I did it, and what I'd do differently....
Security leaders are asking similar questions about agentic coding and how to scale security testing to enable their software teams to deliver max effort....
A self-propagating npm worm ChainDrop republished 1,557 poisoned versions across 435 packages and many unrelated maintainer scopes in a two-hour burst. This is a pattern that is familiar to incident responders, harvesting secrets, republishing packag...
An analysis of cryptographic failures like improper verification of a cryptographic signature and use of a broken or risky algorithm....
Today we're launching nine pre-built Agentic Workflows that hunt for the subtle authentication, injection, and logic flaws that matter most, covering 70+ CWEs across the OWASP Top 10....
Kimi K3's headline numbers look strong, but precision and enterprise-scale performance tell a different story....
Here's the full Semgrep lineup for Black Hat, BSidesLV, and DEF CON 2026: talks, booth sessions, and an exclusive sticker set worth fighting over....
A comparison of several popular open-source options for AI-assisted vulnerability hunting across LLM-led exploitgen, LLM-skill-boosting, and SAST+LLM hybrids...
Is GLM’s viral score real reasoning, or a lucky shortcut? We built a metric to find out....
On 14 July 2026, malicious versions of three AsyncAPI packages were published to npm: @asyncapi/[email protected], @asyncapi/[email protected], and @asyncapi/[email protected] after an attacker gained push access to the repository's next...
OpenAI rated GPT-5.6 as "High" in cybersecurity capability and we estimate the capability jump helps attackers and defenders symmetrically. Our benchmark results are in line with what we’d expect to see from the continued model's exponential trajec...
AI models, even open-weight ones, are far harder to inspect, verify, or trust than traditional software: we currently lack the tools to reliably detect tampering or backdoors in them. The industry urgently needs independent auditors and provenance st...
Not sure whether to hit BlackHat, BSides, or DEF CON, or all three? This guide breaks down what each one offers, plus go-bag essentials, social battery management, and Vegas survival tips from five (or six) years of Hacker Summer Camp....
Every vendor says they're AI-native now. Not all of them mean the same thing. Here are five questions to bring to any vendor call that will separate the tools that really rebuilt something from the ones that stapled a chatbot to a legacy scanner and ...
Your fastest growing attack surface is your AI agent. As AI writes more code than ever, AppSec teams are seeing 10x the vulnerabilities and traditional gates can't keep up. Semgrep Guardian is designed to scan and fix AI-generated code the moment it'...
Among models given nothing but a prompt, the best open-weight option beat Claude Opus 4.8....
How we assess AI for vulnerability detection, and what the newest models show....
It is with a complicated mixture of grief, relief, and the quiet satisfaction of an "I told you so" held in for over a decade that we record the passing of automatic lifecycle script execution in npm, who died at home in package.json on 9 June 2026. ...
Semgrep 1.162.0 fixes a file targeting bottleneck that caused scans on large repos to take hours. By replacing expensive regex calls with string comparisons and a constant-time hash table lookup, P99 diff scan times dropped from ~60 minutes to under ...
Semgrep Pro Engine 1.158.0 ships a redesigned taint analysis engine delivering up to 75% faster full scans. By rearchitecting how taint analysis runs across files, P95 scan times dropped from 10 minutes to 7:30, P99 became significantly more consiste...
Two days later, and Miasma already has a new version. The self-spreading npm worm that first surfaced earlier this week didn't give the creators the results they were expecting. But with a switch from install scripts to binding.gyp, this latest wave ...
Semgrep is open-sourcing Pyro Caml 1.0.0, the first continuous profiler for OCaml, built to run in production under gVisor, sample call stacks via Memprof, and ship data to Pyroscope. This is part one of a three-part series on how Semgrep is improvin...
RedHat becomes the latest victim of an npm worm after a breach affected numerous packages in the @redhat-cloud-services npm organization. With a multi-stage credential harvester that execute automatically via preinstall hooks during npm install....
Twenty-eight years after warning the U.S. Senate that the internet was broken, the security industry has grown but the core problem hasn't changed. We're still writing vulnerable code and patching after the fact. AI is both accelerating the risk and,...
Security tooling only delivers ROI if findings actually get fixed. Semgrep's analysis of 50,000 repositories reveals the five patterns that separate top-performing engineering teams, from shift-left scanning and signal quality to reachability analysi...
It used to be normal for a demo to break or not work at all. That’s not the case anymore....
Mythos is poised to give attackers an unprecedented advantage, but Semgrep can help you restore the balance in your favor....
Supply chain worms keep compromising trusted npm packages by stealing maintainer credentials and letting automated pipelines spread malware before anyone notices. Standard defenses like MFA and version pinning help, but don't fix the root cause. The ...
Malicious packages discovered on NPM started with a compromised maintainer account and spread from @antv/*, timeago, size-sensor, and hundreds more....
Newly published versions of the node-ipc npm package briefly contained an obfuscated infostealer that harvested developer credentials, cloud tokens, SSH keys, CI/CD secrets, and local configuration files before attempting DNS-based exfiltration....
How we turned AI experiments into something customers could rely on in production....
Shai-Hulud has evolved again, the worm starting with TanStack and OpenSearch spread to 400+ packages by no longer needing npm installs to spread....
Malicious TanStack Router packages provide updated Mini Shai-Hulud style worm attack with encrypted exfil of credentials and dead man's switch....
Semgrep Supply Chain now includes Dynamic Dependency Resolution to provide a complete inventory of dependencies when lockfiles are absent, using a combination of manifest parsing and package manager integration. Now in public beta....