What happened
On Nov 12, 2026 Semgrep announced the Agentic AppSec Platform, combining autonomous security agents, Semgrep Guardian (secures code as agents write it), Mandoline (a next-gen program-analysis engine for security agents), a persistent Context Layer knowledge graph, and a new Semgrep MCP server. In Semgrep benchmarks, agents using it found more than twice as many real vulnerabilities as frontier models alone while cutting token costs ~65%; it also integrates with OpenAI's Daybreak Defense Factory and Codex Security.
Why it matters
Code, not just attackers, is now produced at agent speed, and Semgrep makes its analysis directly usable by any coding agent via MCP — closing the human-review bottleneck that agents have multiplied. It reframes AppSec from 'review every finding' to agent-native prevention/fix workflows.
Applicability
AppSec and security teams running AI coding agents (Codex, Claude Code, Cursor) should evaluate; the platform and MCP server are available to Semgrep customers (BYOK, single-tenant, and EU region options).