Semgrep eventsCan AI actually find IDORs in real code?
We tested top coding agents against real-world apps—and the results were mixed. The models discovered genuine vulnerabilities, but also generated large numbers of false positives and inconsistent findings. By dissecting results across multiple authorization complexity levels, we show where LLMs shine, where they fail, and why IDORs remain a uniquely hard class of bugs for AI to reason about.
Expect real examples, surprising failure modes, and practical lessons for anyone considering AI as a security testing assistant.
-
-
Semgrep CodeFind and fix the issues that matter in your code (SAST)
-
Semgrep Supply ChainFix vulnerabilities in open source dependencies and block malware
-
Semgrep SecretsFind and fix hardcoded secrets with semantic analysis
-
Semgrep GuardianScan and fix AI-generated code the moment it's written
-
MultimodalCombine AI reasoning with rule-based analysis for detection, triage, and remediation
-
Semgrep AppSec PlatformAutomate, manage, and enforce security across your organization
-
Semgrep WorkflowsBuild and deploy security pipelines that combine static analysis with AI at scale
-
-
-
Open-Source Malware ProtectionProtect against software supply chain attacks
-
Static application security testingIncrease security while accelerating development
-
OWASP Top 10Prevent the most critical web application security risks
-
Secure GuardrailsProtect Your Code with Secure Guardrails
-
FintechMitigate software supply chain risks
-
SaaS & Cloud
Increase security while accelerating development
-
-
-
DocsWant to read all the docs? Start here
-
BlogGet the latest news about Semgrep
-
ROI Calculator
See how Semgrep can save you time and money
-
Community SlackJoin the friendly Slack group to ask questions or share feedback
-
Events
Join us at a Semgrep Event!
-
Case Studies
See why users love Semgrep
-
Video Library
View our library of on-demand webinars
-
-