--- title: Arm open-sources Metis, an agentic AI security framework... description: Arm has open-sourced Metis, an agentic AI security framework for analyzing large codebases, available on GitHub under Apache 2.0. Unlike traditional SAST tools... canonical: https://daily.dev/posts/arm-open-sources-metis-an-agentic-ai-security-framework-for-large-codebases-4m9dcugyi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Arm open-sources Metis, an agentic AI security framework for large codebases | daily.dev og:description: Arm has open-sourced Metis, an agentic AI security framework for analyzing large codebases, available on GitHub under Apache 2.0. Unlike traditional SAST tools... og:url: https://daily.dev/posts/arm-open-sources-metis-an-agentic-ai-security-framework-for-large-codebases-4m9dcugyi og:image: https://api.daily.dev/og/posts/4m9DCuGYI.png og:image:alt: Arm open-sources Metis, an agentic AI security framework for large codebases og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Arm open-sources Metis, an agentic AI security framework for large codebases **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 1 comments ## Summary Arm has open-sourced Metis, an agentic AI security framework for analyzing large codebases, available on GitHub under Apache 2.0. Unlike traditional SAST tools that rely on pattern matching, Metis uses semantic reasoning and RAG to understand cross-component dependencies and explain vulnerabilities in plain language. Internal benchmarks using GPT-4.5-Cyber show 98% accuracy versus 6% for traditional SAST, with 10x higher true positive rates and ~50% fewer false positives — though these are Arm's own numbers. It supports C, C++, Python, Go, TypeScript, and Rust, works with any OpenAI-compatible LLM, and supports local deployments via Ollama and vLLM. It is already running against 130+ internal Arm projects. ## Content Arm has open-sourced [Metis](https://github.com/arm-research/metis), an agentic AI security framework built by their product security team. It's available on GitHub under an Apache 2.0 license and is already running against 130+ internal Arm projects. ## What it does differently Traditional static analysis security testing (SAST) tools work by pattern matching - they look for known bad code patterns and flag them. Metis takes a different approach: it uses semantic reasoning and retrieval-augmented generation (RAG) to understand cross-component dependencies and reason about vulnerabilities in context. When it finds something, it explains its findings in plain language rather than just pointing at a line number. The practical difference shows up in the numbers. In internal benchmarks using GPT-4.5-Cyber, Metis hit 98% accuracy compared to 6% for traditional SAST tools, with true positive rates up to 10x higher and roughly 50% fewer false positives. Those are striking numbers, though it's worth noting these are Arm's own internal benchmarks rather than independent evaluations. ## Technical details Metis supports C, C++, Python, Go, TypeScript, and Rust. It works with any OpenAI-compatible LLM and supports local deployments via Ollama and vLLM, so teams that can't send code to external APIs have options. The agentic design means it can reason across a large codebase rather than analyzing files in isolation - which matters for the kinds of vulnerabilities that only appear when you trace data flow across multiple components. ## Availability The code is on GitHub under Apache 2.0. Given that it's already monitoring over 130 Arm software projects internally, it's not purely experimental - though teams evaluating it should run their own benchmarks against their specific codebases before drawing conclusions about accuracy. ## Similar posts on daily.dev - [AI SAST: Code Security for the Agentic SDLC](https://daily.dev/posts/ai-sast-code-security-for-the-agentic-sdlc-sxvc4pirt) · SD Times · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#rag](https://daily.dev/tags/rag), [#agentic-ai](https://daily.dev/tags/agentic-ai) [View this post on daily.dev](https://daily.dev/posts/arm-open-sources-metis-an-agentic-ai-security-framework-for-large-codebases-4m9dcugyi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Arm open-sources Metis, an agentic AI security framework for large codebases","url":"https://daily.dev/posts/arm-open-sources-metis-an-agentic-ai-security-framework-for-large-codebases-4m9dcugyi","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/arm-open-sources-metis-an-agentic-ai-security-framework-for-large-codebases-4m9dcugyi"},"datePublished":"2026-06-04T11:45:18.910Z","dateModified":"2026-06-04T11:45:57.194Z","description":"Arm has open-sourced Metis, an agentic AI security framework for analyzing large codebases, available on GitHub under Apache 2.0. Unlike traditional SAST tools...","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/arm-open-sources-metis-an-agentic-ai-security-framework-for-large-codebases-4m9dcugyi","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,rag,agentic-ai","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Arm open-sources Metis, an agentic AI security framework for large codebases"}]} ```