Semgrep Launches Agentic AI Platform for Application Security
The platform gives any AI agent the tools, context, and guided workflows to prevent, find, and fix vulnerabilities as fast as agents write code
“Review has always been the hardest part of software development to speed up, and agents have multiplied the code waiting for it,” said Isaac Evans, CEO and co-founder of Semgrep. “Since October, attackers have been running agents against whatever ships, around the clock. Security tools designed around a person reviewing every finding cannot close that window. That’s why we’ve made Semgrep agent-native.”
Read more – Optiv Expands Threat Exposure Management Services
Semgrep’s analysis is built to be used by agents beyond its own, including OpenAI. Semgrep integrates with the OpenAI Daybreak Defense Factory and is a member of OpenAI Trusted Access for Cyber, and through their integration with OpenAI Codex Security, teams can import Semgrep findings directly into the Defense Factory using OpenAI’s own guide.
“With Daybreak Defense Factory, security teams can bring findings from Semgrep together with context from their other tools to investigate vulnerabilities and prepare fixes,” said Matt Boyle, Head of Product Engineering for Cyber, OpenAI. “This helps defenders act on the findings they already have, using the tools they already use.”
Across the platform, Semgrep’s security agents detect, triage and remediate vulnerabilities autonomously, and any coding agent can access Semgrep directly through Semgrep Guardian or the new Semgrep Model Context Protocol (MCP) server.
Securing Code at the Speed of AI Agents
Together, the capabilities follow agent-written code wherever it goes, whether an agent is still drafting it, a pipeline is testing it, or a security team needs to act on an entire class of vulnerabilities at once:
- Semgrep Guardian secures code as agents write it in any coding harness, fixing issues before they reach a commit and sparing developers and security teams additional rounds of pull requests.
- Agentic Workflows identify subtle authentication, authorization, injection and business logic vulnerabilities that pattern matching misses, using methods developed by Semgrep security researchers. The workflows now also run in continuous integration (CI) pipelines.
- Mandoline, Semgrep’s program analysis engine for security agents, traces control and data flow from entry points and returns only reachable code paths in milliseconds, so agents don’t spend tokens searching through files.
- Context Layer maintains a persistent knowledge graph of each organization’s code facts, documentation, threat data and developer feedback, so each workflow run builds on the last, making findings repeatable and auditable.
- Semgrep MCP server connects agents in Codex, Claude Code, Cursor and other MCP-compatible tools to the full platform, so any agent a team already uses can apply Semgrep’s analysis across a codebase.
- Flexible deployment options, including bring-your-own-key (BYOK) models, Semgrep Dedicated single-tenant hosting and an EU multi-tenant region, address common enterprise requirements for adopting AI-driven security.
Read more – DuPont Partners with Microsoft and NobleAI to Advance AI
Built Natively for Agents
Semgrep combines AI reasoning with purpose-built program analysis and persistent security context, giving its security agents the information they need to identify real vulnerabilities without repeatedly searching entire codebases. Mandoline provides fast and precise information about code paths in milliseconds, while Context Engine preserves knowledge of each organization’s environment across runs. Both power Agentic Security Workflows behind the scenes, so customers benefit without having to learn or manage the underlying technology.
“Finding a real vulnerability comes down to whether attacker-controlled input can reach a dangerous operation,” said Drew Dennison, co-founder and CTO of Semgrep. “Models can reason about intent, but they can’t reliably trace that path across a large codebase. Mandoline does, so our agents spend their reasoning on the issues that matter.”
For security teams, that design delivers:
- More true positives: In Semgrep benchmarking, agents equipped with Semgrep find and resolve more than twice as many true positive vulnerabilities as frontier models alone. A Fortune 50 customer saw 9x more CVEs reported with Semgrep + Mythos vs. Mythos alone.
- Lower cost: a 65% average reduction in token cost for security operations when agents use Mandoline in Agentic Workflows.
- Less noise: Findings reflect each organization’s own code, documentation and developer feedback, so security teams spend less time on alerts that don’t apply to their environment.
“Semgrep’s agentic workflows have transformed our code security program, expanding the coverage of the code we scan and making those scans more reliable,” said Brandon Spruth, Principal Product Security Engineer at ServiceNow.
Together, these capabilities help application security scale with agentic development rather than falling behind it. Guardian identifies and fixes issues as coding agents work, while Agentic Security Workflows investigate and remediate vulnerabilities across the codebase. Security teams can focus more attention on risks that require human judgment rather than spending their time managing growing backlogs.
Write to us editorial@demandmediaagency.com. to learn more about our exclusive editorial packages and programmes.
