Semgrep Assistant, a set of surgical AI tools for AppSec
Heya HN, excited to show off what I've been privately calling an AI cybersecurity tool built by AI skeptics. Two years ago we started a series of experiments with this philosophy of identifying small pieces of cognitive work where a human can very clearly map out the input data they need and the algorithm they'd follow to make a decision. This idea came partly out of frustration with the zeitgeist involving throwing broad AI features (e.g. useless chat bots) into products that end up unreliable and are targeting no clear problem a user might actually have. It feels kind of like a machete vs.…
What it does
In the maker’s words, at launch
Heya HN, excited to show off what I've been privately calling an AI cybersecurity tool built by AI skeptics. Two years ago we started a series of experiments with this philosophy of identifying small pieces of cognitive work where a human can very clearly map out the input data they need and the algorithm they'd follow to make a decision. This idea came partly out of frustration with the zeitgeist involving throwing broad AI features (e.g. useless chat bots) into products that end up unreliable and are targeting no clear problem a user might actually have. It feels kind of like a machete vs. scalpel approach. For one, Semgrep (without AI) emits a stream of possible vulnerabilities found via static analysis, and Assistant reviews this stream of vulns to filter out obvious false positives. This happens before developers are notified, so that we can prevent posting PR comments that would annoy devs, and instead just hold those notifications for review by an AppSec team. This seems to help increase trust in the security tool overall, as devs are less likely to approach alerts with skepticism. Second, things deemed true positives also come with specific AI-generated instructions on how to solve them. This is one of the parts where the 'surgical' approach helped immensely; we noticed that as humans we usually first try to find a past instance of someone successfully fixing a similar problem in git history, and we look at the project dependencies to see what libraries are readily available. So both these are included in the context we pass in the prompt, which leads to some very impressive code generation that uses even internal libraries correctly when it's required to sanitize data, for example. The most recent addition to this whole system is our memories system though. When users triage findings and leave comments such as "Anything under the /dashboard/ prefix is internal access only", Semgrep Assistant parses this for information it might want to learn to apply to triage decisions or fix instructions, and checks if these new facts apply to existing findings you already had in the backlog. We had a customer whose backlog was cut by around 40% by adding just 4-5 memories that explain common reasons vulns do not apply in their environment. I know it's a saturated space but my team believes our approach is actually useful, so we're expecting comments written with some suspicion but optimistic we can convince some of there's something real[0] here (: [0]: https://semgrep.dev/blog/2024/does-your-llm-thing-work-how-w...
Does the same job
all alternatives →- WPWe post-trained a model that pen tests instead of refusingJun 2026 · argusred.com · ▲93
Anthropic and OpenAI's publicly available models are explicitly guard-railed so that they refuse offensive tasks. And their cyber-focussed models are gated for enterprises. This leaves SMEs and mid market open to major vulnerabilities. AI can be used as both an adversarial and defensive tool in the world of cyber. A worst case outcome is if only the adversaries have access. Meanwhile, most existing AI cyber tools are just wrappers. The problem is that they still have all the guardrails on from the foundation model where they will inherit its refusals. For this project we've post-trained a…
- IBI built an AI personal assistant that picks up your calls2025 · apps.apple.com · ▲5
hey hacker news! no matter what I have tried, nothing actually got rid of spam calls. built an AI agent that picks up your phone to filter out these spammers dynamically. next on the roadmap is automating scheduling
- BEBraintrust – Eval platform for AI products2023 · ▲8
Hey HN, We're excited to introduce Braintrust, a platform for running and tracking AI evaluations (“evals”) [1]. At my previous startup Impira and leading AI at Figma, we had this recurring problem where we never knew if changes we made to our products would improve or regress key user scenarios. We built some tooling to solve this problem and after talking to other developers learned that it was a widespread issue. Specifically, it’s challenging to establish a great dev loop that lets you systematically improve and ship high quality AI products. We worked with the teams at Zapier, Coda, and…
- RGRAG-Guard: Zero-Trust Document AI2025 · github.com · ▲9
Hey HN, I wanted to share something I’ve been working on: *RAG-Guard*, a document AI that’s all about privacy. It’s an experiment in combining Retrieval-Augmented Generation (RAG) with AI-powered question answering, but with a twist — your data stays yours. Here’s the idea: you can upload contracts, research papers, personal notes, or any other documents, and RAG-Guard processes everything locally in your browser. Nothing leaves your device unless you explicitly approve it. ### How It Works - * Zero-Trust by Design*: Every step happens in your browser until you say otherwise. - * Local…
- IAInsight, an autonomous AI that can do medical research2023 · github.com · ▲7
I am working on an AI that uses multiple LLM based agents to do medical research on any topic you choose! The program terminates after a set number of iterations and all of the findings are saved. Still a work in progress but it is showing some promising results imho! Would love to receive any critical and constructive feedback, collaborate, Review your PRs, or discuss your ideas!!
More ai this month
the category →
I trained a 125M-parameter transformer to autocomplete piano performances in real time (~108 notes/sec on an iPhone 15). The idea is basically GitHub Copilot or Tabnine, except instead of prompting it with code, you prompt it by playing a few notes on a MIDI piano. The model then continues what you played, entirely on-device. The app is free if anyone wants to try it. Happy to answer questions about the model, training, Core ML, or the many things that didn't work.
AI · 17d ago · simedw.com
Astute▲585Automate your B2B brand going viral, with new media creators
AI · 18d ago · company-app.joinastute.com
Hey HN, Henry from Cactus here! We previously released Cactus Needle, a 14MB agentic LLM for tool call, device use, and structured extraction for phones, wearables, smart homes, small robots and microcontrollers. We got really great feedback here, and have now incorporated the suggestions to release Needle 2. The whole model is a single 14MB binary that runs a full session in 28MB of RAM; 45m parameters at 2bit compression. Needle hits 500 tokens/sec decode speed on a Raspberry Pi 5, sits between 400-1,500 tokens/sec on VR devices like Meta Quest 3S and Apple Vision Pro, and ranges…
AI · 27d ago · cactuscompute.com
Launched alongside, January 2025
the whole month →- IM
Hello! I'm Byran. I spent the past ~6 months engineering a laptop from scratch. It's fully open-source on GH at: https://github.com/Hello9999901/laptop
Dev tools · 2025 · byran.ee
- TITetris in a PDF▲1,289
I realized that the PDF engines of modern desktop browsers (PDFium and PDF.js) support JavaScript with enough I/O primitives to make a basic game like Tetris. It was a bit tricky to find a union of features that work in both engines, but in the end it turns out that showing/hiding annotation "fields" works well to make monochrome pixels, and keyboard input can be achieved by typing in a text input box. All in all it's quite janky but a nice reminder of how general purpose PDF scripting can be. The linked PDF is all ASCII so you can just open it in a text editor, or have a look at…
Life & fun · 2025 · th0mas.nl
Create lifelike, personalized AI avatars from text prompts
AI · 2025 · jogg.ai
