Semgrep CEO: frontier models now write working exploits — sandbox your agents, enforce with hooks
blaizedsouza · x · 2026-11-14
Semgrep CEO Isaac Evans told a Stanford course that high-profile exploits and attacks will keep getting worse before they get better.
Key points:
- Frontier models now find vulnerabilities and write working exploits, eliminating the human-talent shortage that kept attacks expensive.
- Chasing every bug is futile — fewer than 2% of published vulnerabilities ever get exploited.
- The leverage is prevention: sandbox agents (containers at minimum, microVMs as the gold standard) and keep credentials out of agent reach; enforce tool choices with deterministic hooks (e.g., pnpm over npm) plus dependency cooldowns, not instructions.
More from coding & agent
- WordPress UTM QA tip: accept cookies and submit forms without refreshing — HaktanSuren · 2026-11-14
- Using Claude to Visualize Ideas in Real Time During Team Calls — Flomerboy · 2026-11-14
- Vercel Token Pass doubles value: $150 in open-weight model tokens for $30/month — cramforce · 2026-11-14
- Dev moves nearly all code changes to subthreads, parent thread just orchestrates — zeeg · 2026-11-14
- Code-generated 3D Where's Waldo with 10,000+ animated people playable in browser — CSProfKGD · 2026-11-14
- Coding agent Junior goes macro-aware, sharing context across parallel sessions — zeeg · 2026-11-14