Semgrep @semgrep

Exposed third-party infrastructure will likely become a recurring theme because the internet is awash in weak software. As models become more capable, they’ll have more opportunities to find and exploit those weaknesses.

Save your spot for the session now! 👉 semgrep.dev/events/where-i…

Everyone's using AI – and if you're not, the FOMO is real. But behind the LinkedIn posts and pitches, plenty of AI-in-AppSec use cases just... don't work. Join Dr Katie and Mehdi as they cut through the noise with what they've actually seen working. Pulling from conference conversations, customer calls, and their own experiments, they’ll share how teams are getting their tokens’ worth of AI.

Malicious Python and JavaScript deps have dominated this year's supply chain news cycle, but how many of y'all still have pinning GitHub Actions on your to do list? Here’s how I did this org-wide at Semgrep. semgrep.dev/blog/2026/sha-…

Millions of developers build on Replit - many with AI agents writing the code. Speed like that needs security that keeps pace. Semgrep Guardian's secrets detection is now built directly into Replit, catching vulnerabilities the moment code is generated. Every scan completes in under 5 seconds and is deterministic on every run, so it doesn't slow developers down or add unpredictable cost to your agent. Paired with Replit's reasoning layer, it filters out >93% of false positives, so developers see high-confidence results, not noise. Live now, no setup required. Read the full announcement: businesswire.com/news/home/2026…  #AppSec #AI #DevSecOps

Black Hat's in the books. Now the vibe shifts: DEF CON is where hacker culture takes over, and where theory meets practical exploitation. Today, 4:30 PM, Crypto & Privacy Village: Diptendu Kar on "Crypto Is Fine. The Code Is Not." Crypto failures rarely come from bad math, they come from the gap between cryptographic theory and secure implementation. This weekend, Bug Bounty Village, Saturday 2:30 PM: @insiderphd and @hackfidgetcube on "Slop Spotting." As AI reshapes how code gets written (and how bug reports get filed), the challenge shifts from finding bugs to finding the right ones. Their talk digs into using SAST rule generation to separate genuine risk from AI-generated noise. IoT Village, Saturday 3:15 PM: Katie's back solo with "Beyond Your Bookshelf: Hackable eReaders." Bring your Kindle. She might jailbreak it on the spot. See you in the villages.

Gotta collect them all! If you missed our sticker drops at BSidesLV come meet us at "It's All Fun and Games" for a scavenger hunt for all 22 designs. See you tonight

Another day at Black Hat, another set of real-world AppSec challenges. Yesterday was about the grind: finding vulns, fixing them, and pushing security upstream. Today, we're staring down the barrel of AI-generated code. It ships fast, but human review? Still moves at human speed. linkedin.com/in/spacerogue/ and Pablo Estrada are tackling this gap at 9:30 AM in the Business Hall – a critical discussion on how not to turn review into a rubber stamp. Then at 3:15 PM on Pulse Stage 4, @drewdennison is talking 'Using SAST + Mythos to Shift Right.' For anyone who thinks 'SAST + LLMs' is just marketing fluff, he's demonstrating how this pairing can actually surface novel, long-buried vulnerabilities at scale. This isn't about shiny new tech; it's about practical strategies to keep pace without burning out our teams. Come share your war stories at booth #4943.

keyboard_arrow_left Previous keyboard_arrow_right Next

We asked security pros at BSides Las Vegas for their hottest takes, and now we're sharing ours! 🔥 Our Head of Product Daghan Altas predicts that automated tools will soon take the reins on most PR code reviews, leaving humans to handle only the essential exceptions, so in a thousand PRs a human only reviews 1 or 2.

Another solid day at Hacker Summer Camp connecting with AppSec folks in the trenches. The recurring theme isn't just finding vulns, it's getting them fixed—and more importantly, preventing them upstream. That means working *with* developers, understanding their pain points, and making security less of a roadblock. It's about pragmatic wins and continuous improvement, not just tool deployment. If you're at Black Hat, swing by booth #4943 to share war stories and strategies for effective developer collaboration. Also, don't miss Katie Paxton-Fear and Milan Williams today at 1:30 PM at our booth, talking about 'Overcoming the Fear of Security Risk with AI-Assisted Development'—a critical topic for practitioner success.

keyboard_arrow_left Previous keyboard_arrow_right Next

Another npm worm: 1,485 poisoned versions, 379 packages, two intrusion paths. One via stolen tokens, another via compromised source/OIDC trusted publishing. The latter bypasses token rotation. This is the new reality: supply chain attacks exploiting *trusted* mechanisms. We've pushed out rules for Semgrep customers and listed the IoCs for those who aren't, read the blog: semgrep.dev/blog/2026/its-…

🔍 We've been pointing fingers at AI, but are we missing the bigger picture? 🤔 Our Security Advocate Cris Thomas, aka Space Rogue, shares his thoughts on why regulation isn't the answer and that we might already know the answer to the AI problem all along... it's people, stupid.

Hacker Summer Camp starts today at BSides Las Vegas, and we can't wait to meet everyone! Swing by our booth to pick up your own custom clicker fidget, pick up some stickers, and share your hot take!

keyboard_arrow_left Previous keyboard_arrow_right Next

We’re excited to sponsor PBC Connect – Black Hat USA 2026 on August 4 at Mandalay Bay in Las Vegas. PBC Connect brings together CISOs, AppSec, infrastructure security, product security, AI security, and cyber resilience leaders for high-value discussion, networking, and community-building. This year’s Black Hat gathering will focus on the future of AI security, vulnerability remediation, product security, and frontier AI risk, including a featured fireside chat with Jason Clinton, Deputy CISO at Anthropic, and Phil Venables, Partner at Ballistic Ventures and former CISO of Google Cloud and Goldman Sachs. The agenda also includes a panel on Operationalizing Security for Mythos-Class Capabilities with Nathan Motyl, Kris Howitt, and Karthik Swarnam. Limited seats are available,  register here: thepurplebook.club/pbc-connect-bl… #BlackHat #CyberSecurity #AISecurity #AppSec #ProductSecurity #PBCConnect

Learn more: semgrep.dev/products/semgr…

Traditional application security tools are great at finding known patterns. They're less effective at detecting subtle authentication flaws, business logic issues, complex injection vulnerabilities, and other weaknesses that require reasoning. Semgrep Agentic Workflows combines AI reasoning with proven static analysis - including Semgrep Pro Engine, Pro Rules, and other analysis tools - to detect the vulnerabilities that traditional tools miss. Because the most expensive vulnerabilities are often the ones that never get found.

Less than a week until Hacker Summer Camp. What's coming for AppSec in the next few years, and what needs to change about how we build security pipelines today? Find Semgrep at Black Hat Booth 4943 to talk it through, and catch our team on stage tackling AI-generated code review, shift-right security, and more. Full schedule: semgrep.dev/events/hacker-…

Read the full post: semgrep.dev/blog/2026/grou…

LLMs for AppSec are generating buzz, but how reliable are they? We audited our own IDOR benchmarks, asking: are models *reasoning* about vulnerabilities, or just getting lucky with pattern matching? F1 isn't enough to know the difference.