---
title: "Did Semgrep Just Get A Lot More Interesting?"
description: "Thomas Ptacek considers whether LLM-driven coding agents could make Semgrep more useful by closing the loop between code generation, execution, and automated repair. He describes Semgrep as a semantics-aware code-search tool whose symbolic variable placeholders and ordinary code can express vulnerability patterns, while noting that teams rarely have time to build extensive rule libraries. Drawing on Cursor’s rules feature, including rules that help organize or generate other rules, he proposes having an agent observe runtime errors, generalize fixes into unit tests, and generate Semgrep rules for the underlying bug. The proposed workflow would test each rule with positive and negative controls, save it, scan the codebase, and fix newly found instances. The post concludes that this adaptive process may be more compelling than predicting every failure in advance."
---

# Did Semgrep Just Get A Lot More Interesting?

[Fly.io](https://yomu.fyi/company/fly-io) · Feb 10, 2025

**Type:** Explainer

## Summary

Thomas Ptacek considers whether LLM-driven coding agents could make Semgrep more useful by closing the loop between code generation, execution, and automated repair. He describes Semgrep as a semantics-aware code-search tool whose symbolic variable placeholders and ordinary code can express vulnerability patterns, while noting that teams rarely have time to build extensive rule libraries. Drawing on Cursor’s rules feature, including rules that help organize or generate other rules, he proposes having an agent observe runtime errors, generalize fixes into unit tests, and generate Semgrep rules for the underlying bug. The proposed workflow would test each rule with positive and negative controls, save it, scan the codebase, and fix newly found instances. The post concludes that this adaptive process may be more compelling than predicting every failure in advance.

## Context

Most teams do not have time to build extensive Semgrep rule libraries, and predicting every failure in a codebase before it occurs is described as tedious and potentially ineffective.

## Approach / What changed

Use a closed-loop LLM agent that observes runtime errors, fixes them, generalizes the fixes into tests, generates Semgrep rules for the underlying bugs, validates those rules with positive and negative controls, scans the codebase, and fixes matching issues.

## Takeaways

- Semgrep uses symbolic variable placeholders and ordinary code to express searches for vulnerability patterns and other code-level footguns.
- The proposed agent workflow includes testing generated rules with positive and negative controls before saving and applying them across the codebase.
- Cursor’s rules can be used to constrain the agent, including a rule that prevented it from choosing Bazel and rules that help organize or generate further rules.

**Tags:** [Cursor](https://yomu.fyi/topic/cursor), [LLMs](https://yomu.fyi/topic/llm), [Semgrep](https://yomu.fyi/topic/semgrep)

- Source: [Fly.io](https://fly.io/blog/semgrep-but-for-real-now)
- Source URL: https://fly.io/blog/semgrep-but-for-real-now
- Ingested by Yomu: 2026-09-02T11:57:27.288Z

[Read original post](https://fly.io/blog/semgrep-but-for-real-now)