Semgrep Assistant, now documented as Semgrep Multimodal, is the AI layer of the Semgrep application security platform. It adds AI-powered detection, triage and remediation on top of Semgrep Code findings. Detection scans look for complex business logic flaws such as insecure direct object references and broken authorization by combining static analysis with contextual reasoning. For each finding it explains why the result is a true positive, highlights the relevant code, and gives step-by-step remediation guidance, with Autofix able to open pull requests containing proposed changes.
Security engineers and AppSec teams use it to cut triage time, while developers get explanations and fix suggestions directly in pull request or merge request comments. Teams that already run Semgrep Code across their repositories gain the most, since the feature works on the same languages and requires the Semgrep AppSec Platform. Larger organizations with long finding backlogs benefit from autotriage, weekly priority emails and component tags that categorize findings by the part of the codebase affected.
A typical workflow starts with a full scan where new Critical or High severity findings with High or Medium confidence are analyzed automatically. In pull requests, up to 10 new findings per scan are analyzed and commented on with an explanation and fix guidance. A security team can review autotriaged results on the Findings page, filter noise with the beta noise filtering option, and use Memories to record feedback so later suggestions reflect their custom rules and preferred sanitizers. Upgrade Guidance, also in beta, helps with dependency fixes.
