Semgrep

Code security company (semgrep.dev). Semgrep researcher Cris Thomas, quoted in Reuters’ coverage of the Taiwan AI-agent government intrusion, supplied the wiki’s operative caution against reading a “near-autonomous” attack framework as fully autonomous: “There’s still a human in there somewhere. Somebody had to choose who to attack, had to establish an objective and give it a directive. It’s not totally 100% autonomous.”¹

Comparative Harness Survey (July 2026)

In July 2026 Semgrep published a comparison of nine open-source harnesses that point a language model at a codebase, sorting them into LLM-led exploit generation, LLM-skill-boosting vulnerability research, and SAST-plus-LLM hybrids, and setting out six cross-cutting findings on discovery-validation separation, the blurring static/dynamic line, adversarial validation, language coverage, what each harness counts as a finding, and how uncommon patch generation remains. Semgrep answers the market-consolidation question directly — a reference open-source harness will not emerge today, and many organizations will build their own “shop jigs” for vulnerability finding — and names that pace as the reason harnesses ship marked unmaintained or closed to external contributions. Semgrep’s own engine appears inside the field it surveys: ai-deep-sast triages Semgrep findings with a language model, RAPTOR runs Semgrep alongside CodeQL, and Trail of Bits’ static-analysis skill wraps both.² Semgrep also maintains semgrep/defending-code-harness, a fork of Anthropic’s anthropics/defending-code-reference-harness, which the survey reports as unmaintained. See the paper page for the full nine-project comparison and the open-source harness landscape for the per-project detail.

Notes

Footnotes

1. Taiwan says it was targeted last month in AI-driven hacking campaign, Reuters, 2026-08-13. ↩

2. Semgrep — Comparing open source AI code security harnesses, July 2026 (no day-level date exposed; author not named). The taxonomy, the six findings and the market-consolidation argument are human-written; the static-analysis skill’s description is from Semgrep’s LLM-generated repository summary. Summarized at OSS AI Security Harness Comparison. ↩