The customer is now an agent
The platform assumes its reader is a coding agent, not a person clearing a queue of findings. Semgrep describes the components as follows. Guardian watches code as an agent writes it and fixes issues before a commit. The MCP server lets an agent in Codex, Claude Code or Cursor call Semgrep's analysis directly. Mandoline, the analysis engine underneath, traces control and data flow from entry points and returns only the code paths that are actually reachable, in milliseconds, so the agent does not spend tokens searching through files. A Context Layer keeps a persistent graph of each organization's code, documentation and developer feedback, so each workflow run builds on the last.
The design argument is coherent, and Semgrep's CTO states it plainly: a model can reason about intent, but it cannot reliably trace whether attacker-controlled input reaches a dangerous operation across a large codebase. That tracing is what a purpose-built engine is for. Whether the argument survives contact with real codebases is a separate question, and it is the question the launch numbers are meant to answer.
Three numbers, one author
This account is based on Semgrep's launch release; ALFW has not independently tested the platform or reproduced its results. Semgrep reports three numbers. Agents equipped with the platform, including Semgrep's own Mandoline, found more than twice as many real vulnerabilities as frontier models alone. Token costs in its Agentic Security Workflows fell by an average of 65%. And a Fortune 50 customer saw 9x more CVEs reported when Semgrep was paired with Mythos than Mythos produced on its own.
Each figure is attributed in the release to Semgrep itself: "In Semgrep benchmarks," "In Semgrep benchmarking." No methodology is published with them. The frontier models in the 2x comparison are not named. The codebases are not described. The 9x figure has the weakest footing of the three: a single customer, unnamed, and without baseline counts, readers cannot assess the absolute increase behind the reported ninefold result.
None of this makes the numbers false. It makes them uncheckable on the day they are doing the most work, which is launch day. The honest way to hold them is as a claim about what Semgrep's tooling adds to a model, awaiting a run Semgrep did not grade.
Why the OpenAI badge is in the release
Semgrep issued the release the same day as OpenAI's Cyber at the Frontier event, where its staff were on site, and it leads with integration: the platform integrates with OpenAI's Daybreak Defense Factory, Semgrep sits inside OpenAI Trusted Access for Cyber, and teams can import Semgrep findings into the Defense Factory through the Codex Security integration, using a guide OpenAI itself published. OpenAI's head of product engineering for cyber, Matt Boyle, is quoted supporting the integration.
Read that connection as distribution, not validation. The integration establishes a route for findings into the Defense Factory; it does not independently validate Semgrep's benchmark results. It also means the claims now travel with OpenAI's event attached to them, which is exactly why they deserve to be read at the speed the fine print requires. The platform is available to Semgrep customers now. The benchmarks will be worth revisiting when someone other than Semgrep runs them.
Sources
- [1] Semgrep, "Semgrep Launches Agentic AppSec Platform to Eliminate the Security Bottleneck" (Business Wire, November 12, 2026)Read source