Episode 204: Open Source in the Age of Agents With Isaac From Semgrep

In this episode, our co-hosts Robby and Tim talk with Semgrep Co-Founder & CEO Isaac Evans about the evolution of application security, the Semgrep journey, and building developer tooling in the agentic age. Semgrep's open source static scanner has almost 18K stars on GitHub and finds bug variants with patterns that look like source code.

In this episode, we get into the evolution of application security, from the early days of developer security tooling to a world increasingly shaped by AI agents. Isaac shares how his interest in security began at MIT, where he recognized that securing software would become a critical bottleneck to unlocking new technologies. We trace Semgrep’s origins from an internal tool at Facebook to an open-source project and eventually a security platform, including the early customer use cases that shaped the company’s approach to finding vulnerabilities. We also discuss the changing dynamics of open source, why Semgrep is becoming more conservative about what it releases publicly, and how AI is fundamentally reshaping the economics of vulnerability discovery.

Looking ahead, we dive into what it means to build security tools for AI agents rather than humans, why the next generation of security products will need to expose deeper capabilities through APIs and agent-native interfaces, and how the rise of AI-generated code is changing who builds software and who is responsible for securing it. He explains why a world with zero vulnerabilities is unlikely, how the roles of security engineers and vulnerability researchers may diverge as AI improves, and why complexity remains the enemy of security. Finally, we discuss how Semgrep is thinking about speed as a growing company, not simply shipping more, but tightening customer feedback loops and increasing how often it delivers meaningful value.

Full episode here