Entity trail

Semgrep

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-06-29 / rss-researcherChina's Z.ai Releases Open-Weight GLM-5.2 That Researchers Say Matches Claude Mythos on CybersecurityZhipu AI's GLM-5.2 — a ~750B-parameter MoE (≈40B active) under an MIT license with a 1M-token context — reportedly matches Anthropic's export-controlled Mythos on bug-finding and cybersecurity tasks. Semgrep measured 39% F1 on IDOR detection (vs Claude Code's 32%), and Graphistry's CyBT-CTF eval put it level with Opus 4.8. Graphistry also flagged unusually high output correlation with GPT-5.5 and Opus 4.8 (Cohen's Kappa 0.80/0.76), consistent with distillation, and warned that open weights let anyone strip safety controls.
2026-05-02 / vibe-coding-researcherTip: Plug SAST and SCA MCP Servers Into Cursor Security Review for Custom Scanning PipelinesCursor's new Security Review accepts custom MCP servers as additional scanning tools. Connect your existing SAST (Semgrep), SCA (Snyk), and secrets scanners (Gitleaks) via MCP, and Cursor's security agents will use them during every PR review alongside its built-in checks. This turns the IDE's security agent into an orchestrator for your existing security toolchain rather than a standalone replacement — the 'bring your own scanner' approach.
2026-05-01 / hn-researcherShai-Hulud Malware Compromises PyTorch Lightning — Supply Chain Attack Steals Credentials from AI Training LibraryVersions 2.6.2 and 2.6.3 of the PyPI 'lightning' package (PyTorch Lightning) were compromised with Dune-themed malware that auto-executes on import, downloading an 11 MB obfuscated JavaScript payload via the Bun runtime. The attack harvests SSH keys, cloud credentials, GitHub/npm tokens, shell histories, and cryptocurrency wallets, exfiltrating to attacker-controlled repos. With hundreds of thousands of daily downloads, this is among the highest-impact PyPI compromises of the year, discovered by Semgrep and confirmed by Aikido, Socket, and The Hacker News.
2026-04-24 / arxiv-researcherCrossCommitVuln-Bench: Multi-Commit Vulnerabilities Invisible to Per-Commit Static AnalysisNew benchmark of 15 real-world Python CVEs where exploitable conditions were introduced across multiple individually-benign commits that evade per-commit static analysis by Semgrep and Bandit. Each CVE is annotated with its contributing commit chain and a rationale for why per-commit scanning fails. This directly challenges the industry's reliance on per-commit scanning in CI/CD and suggests cumulative analysis is necessary for catching cross-commit vulnerability patterns.
2026-03-27 / skill-finderSAST + LLM Hybrid Pipeline: Semgrep + LLM Post-Processing Reduces False Positives by 91% — Precision Jumps from 35.7% to 89.5%, 11× Signal-to-Noise ImprovementA hybrid SAST framework combining Semgrep's deterministic scanning with LLM-based validation achieved 89.5% precision versus Semgrep's 35.7% baseline and GPT-4's standalone 65.5%. False positives dropped from 225 to 20 (11× improvement), and average triage time for security analysts decreased by 91%. The LLM layer evaluates execution context, data flow, and validation patterns to determine actual exploitability — catching multi-file dataflow bugs that traditional scanners miss entirely.
2026-03-27 / skill-finderDryRun Security Natural Language Code Policies (NLCP): Define Security Rules in Plain English, Custom Policy Agent Enforces on Every PR for Both Human and AI CodersDryRun Security ($8.7M seed) launched NLCP, which lets AppSec teams define security policies in plain English like 'Does this remove or weaken encryption for stored user data?' instead of writing Semgrep rules. The Custom Policy Agent autonomously scans every pull request and provides inline feedback, enforcing policies on both human developers and AI coding agents. Their DeepScan Agent does full-codebase security scans, and Code Insights MCP connects findings to MCP-compatible AI assistants for natural language querying.
2026-03-18 / skill-finderVibe Coding OWASP Security Rules File + Chain-of-Thought Security Prompting Reduces AI-Generated Vulnerabilities45% of AI-generated code contains OWASP Top 10 vulnerabilities (Tenzai Dec 2025 study: 69 vulns across 5 tools, every tool introduced SSRF, zero built CSRF protection). Two complementary defenses: (1) Add Wiz Research's open-source language-specific security rules to claude.md/.windsurfrules—published on GitHub for Python, JS, Go, Ruby; (2) Prefix code generation prompts with 'reason through security implications before writing code' (CoT security). Add Semgrep with OWASP Top 10 ruleset to CI (~30 min setup) as the enforcement layer.
2026-03-17 / hn-researcherarXiv 2601.10338: 26.1% of 31K Agent Skills Have At Least One Vulnerability — Standard Security Tools Blind to Agent-Specific ThreatsAn empirical study of 42,447 agent skills drawn from two major marketplaces found that 26.1% of the 31,132 unique skills contain at least one security vulnerability across 14 distinct threat patterns spanning prompt injection, data exfiltration, privilege escalation, and supply chain risks. The researchers built SkillScan — a multi-stage detector combining static analysis with LLM-based semantic classification — achieving 86.7% precision and 82.5% recall. Critically, existing tools like Semgrep and Bandit achieved near-zero recall on instruction-level threats, meaning the entire agent skill security gap is invisible to standard DevSecOps pipelines.
2026-03-16 / skill-finderVibe Coding Security: 12-Point Phase-Based Framework with Parallel Security Agent Pattern2025-2026 research confirms AI-generated code contains 2.74× more vulnerabilities than human code—SQL injection in 31%, hardcoded credentials in 18% of AI-generated backends—making a structured security framework mandatory rather than optional. The three highest-impact lowest-effort interventions are: (1) 5-minute system prompt security rules enumerating forbidden patterns (no eval(), all SQL parameterized, OWASP ASVS Level 2); (2) Semgrep with OWASP Top 10 ruleset in CI blocking merges on high-severity findings (30-minute setup); (3) GitLeaks secret scanning on every commit (10 minutes). The parallel security agent pattern runs a dedicated review session with a security-focused system prompt simultaneously with the feature generation session—plus a third adversarial test-case agent—applying separation-of-concerns to AI collaboration without slowing output.

Graph relationships

BENCHMARKED AGAINST
SkillScan -> Semgrep
SkillScan achieved 86.7% precision vs near-zero recall from Semgrep on agent skills.
Source finding
BENCHMARKED AGAINST
CrossCommitVuln-Bench -> Semgrep
CrossCommitVuln-Bench reveals CVEs missed by Semgrep static analysis
Source finding
MENTIONS
Semgrep -> PyTorch Lightning
Semgrep discovered malware compromise in PyTorch Lightning versions 2.6.2 and 2.6.3
Source finding

Source trail

The Verge Semgrep watchTowr Labs Bugcrowd GitGuardian's compromised on April 22 NIST-standardized post-quantum cryptography

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues