Day 2 at Gartner. Edwin, our PMM: “There’s a solution for pretty much everything. What people are missing is a standard around how to secure AI.”

AI coding agents are generating more code, faster. Security needs to keep up. 🔒 Join us for a hands-on session with Semgrep Guardian to see how security fits directly into AI coding workflows with Claude and Codex. See how Guardian detects vulnerabilities as code is being written and helps teams address security risks earlier, without slowing developers down. 🧱 Build beyond the code! Join live for a chance to win one of three $50 LEGO gift cards. 📅 October 21 | 8 AM PT Get hands-on with Guardian → semgrep.dev/events/get-hands…

Your developers are shipping faster than ever. Your security team is trying to keep up. On Oct 22, Isaac Evans (CEO, Semgrep) joins Viraj Gandhi from ServiceNow and Varun Agaskar from Broadridge Financial for the session “Security at the Speed of Development” at the PBC Agentic AI Security Conference. It’s a conversation, not a slide deck. Here’s what they’ll get into: How the secure SDLC changes when AI writes more of the code What it takes to build security into developer and agent workflows, not just bolt it on at review time Which policies can become automated checks, and which still need a human call Why application and infrastructure risk belong in the same conversation Join us for real talk and practical steps you can take tomorrow. October 22, 10:00 - 10:30 AM PT ttps://armorcodeinc.registration.goldcast.io/events/0a66b331-f6fb-4bd2-897f-468a7c6ed390?__hstc=14956073.22adf95f00a7cb40122d709247769689.1791980575910.1791980575910.1791980575910.1&__hssc=14956073.1.1791980575910&__hsfp=a0a1851a45f4a97708ee74c66b52c7bc#Registration

They did not break in: they published. That line from the Beagle Brigade team sums up how package registry malware works. A stolen maintainer token becomes a new version of a package you already depend on, and it runs on every laptop and CI runner that installs it, before anyone opens a file. Their project took second place in our Semgrep Guardian challenge at the Cyberdefense Hackathon during SF Tech Week. Each new release on a registry like npm or pypi is pulled into a sandbox. It’s analyzed with Semgrep dataflow rules without ever being executed. Anything suspicious goes to an AI agent that returns a verdict. What we liked most is that the analysis never runs what it downloads. When the threat is code that executes on install, analysis that doesn’t execute anything is the safe place to start. It’s the same threat Semgrep Guardian’s malware firewall is built for with malicious dependencies. Congrats to the Beagle Brigade team! #SFTechWeek

Repos hosted in Cursor Origin can now connect to Semgrep. Automated scans, PR checks, and findings in the workflow you already use. semgrep.dev/blog/2026/cursor…

Only raise a security issue you can prove. That was the idea behind a hackathon project which took first place in our Semgrep Guardian challenge at the Cyberdefense Hackathon during SF Tech Week. A static deterministic check runs first, so most saves never reach a commit at all. The findings go into the model's context as evidence. Anything the model suspects is then run in a sandbox with canaries. Only proven issues reach the developer, and each comes with a fix that’s re-checked the same way. Static analysis is cheap and precise about what the code says. A model is good at asking whether it matters in a project. Of the 63 projects submitted, this was one of the clearest examples of each security layer doing the task it’s best at. Congrats to the Reva team! #SFTechWeek

Origin, Cursor’s code hosting platform, now supports over 20 integrations. Connect your repos to tools for CI, deployments, code review, security, monitoring, and project management.

🚨 tensorlake@0.5.144 on npm is compromised. The Shai-Hulud-style worm steals tokens, cloud keys and secrets, then spreads through your npm packages and repos. ⚠️ If you revoke the stolen GitHub token, a "hostage" service runs rm -rf ~/. Remove gh-token-monitor first. If you're a Semgrep supply chain customer we pushed rules out about an hour ago.

Your developers will keep switching AI coding tools. Your security gates shouldn't have to switch with them. Semgrep Guardian now supports Codex. Every file Codex writes gets scanned as soon as it's written. It joins Cursor and Claude Code, and you can deploy it org-wide through MDM. Whatever your stack, we'll meet you there. semgrep.dev/blog/2026/why-en…

The rise of AI-generated code isn't just a technical shift; it's a fundamental change to how we manage AppSec risk. If you're not thinking about automation today, you're already behind. The sheer volume and velocity of AI-driven development will drown any manual review process. Our take? Identify your control points and your most likely risks. For AI-generated code, those control points might be the AI agent's output, the commit before PR, or even pre-deployment. Your risks? Supply chain attacks, vulnerabilities, known CVEs. We need to build automated gates at these points. That could mean linting tools, SAST, or even custom scripts that analyze LLM tokens for risky patterns. The goal isn't 'zero vulnerabilities' (that's a fantasy) but 'zero *known, preventable* vulnerabilities' making it past your earliest control point. You're trying to shift the burden from human review to automated checks. It's about empowering developers to catch issues the instant they're introduced, not weeks later in a pentest report. If your automation can catch 80% of the common issues, your team can focus on the hard 20%.

We’ve had 22 years of Cybersecurity Awareness Month. People are aware. People know phishing is bad, ransomware exists, and passwords shouldn’t be “password.” Mission Accomplished! Let's rename it Cybersecurity Readiness Month. semgrep.dev/blog/2026/rename…

⚠️ Your AI coding agent just found a new way around your security scanner. A recent Claude update changed how agents write files. Instead of Write and Edit, they now often go through Bash: cat > file <<EOF, sed -i, echo >>. Most scanners never see this code, and don’t think to check it for security issues, leaving a major gap in coverage. Guardian v2.2.0 now scans file changes Claude makes through Bash too. Your coverage stays the same, no matter how the agent writes code. The broader lesson for anyone securing agents: guard the outcome (a file changed), not the tool call. Agent behavior shifts with every model and prompt update. Update the plugin today. #AppSec #AIsecurity

"Shift left" assumed a human would review the code. Vibe coding doesn't. @0xine at @WeAreDev World Congress discussing what security looks like once that assumption breaks. If AI-generated code is anywhere near your software lifecycle you will want to watch the recording.