Arm dropped a new tool for teams drowning in false positives. On May 28, the company open-sourced Metis, an agentic AI framework designed to catch the kind of multi-layer vulnerabilities that static analysis tools routinely miss. The code is on GitHub under Apache 2.0, and the numbers are worth a closer look.
Internally, Metis already scans over 130 Arm software projects. Full rollout across the company is slated for late 2026. In benchmarks that deliberately avoided AI training data, Metis delivered up to 10x higher true positive rates and cut false positives by roughly 50 percent compared to leading static analysis tools. That means engineers spend less time triaging noise and more time fixing actual bugs.
Architecturally, Metis uses retrieval-augmented generation (RAG). It builds a custom knowledge base from source code, build files, and documentation, then lets large language models reason over that context. The system can review entire repositories, single files, pull requests, or recent changes. It constructs dependency graphs, gathers evidence, and explains why something matters—rather than just pattern-matching like a traditional scanner.
One internal setup pairs Metis with OpenAI’s GPT-5.5-Cyber model via the Daybreak API. Results from a firmware and driver analysis across 352 cases showed Metis finding 98 percent of known vulnerabilities versus 6 percent for traditional SAST. That’s not a typo.
Language support covers C, C++, Python, Rust, Go, TypeScript, Solidity, Verilog, and more. A plugin system makes adding languages straightforward. Engineers run commands like `index`, `review_code`, or `review_patch`. Output includes clear explanations and suggested fixes—one example flags a memory remapping loop that forgets to write back changes, explains the risk, and offers corrected code.
Configuration lives in YAML. Teams choose LLM providers, tweak prompts, adjust chunking, or swap vector stores between ChromaDB and PostgreSQL with pgvector. Docker images simplify deployment. The CLI works interactively or in non-interactive mode for CI pipelines. Not every shop wants to ship code to OpenAI, so local models via Ollama or vLLM are supported. Output formats include SARIF for integration with existing toolchains.
Arm’s own engineers built Metis because they faced the same scaling problems everyone does. The decision to open source it reflects a bet that collective progress beats closed competition. The framework is defensive—it scans code, it doesn’t act in production—but its agentic nature (autonomous reasoning loops, tool use, iterative validation) mirrors the systems now raising new governance questions.
Limitations exist. LLM hallucinations remain possible even with strong RAG. Arm stresses that Metis augments engineers, not replaces them. Findings still need human oversight. Custom prompts and organization-specific policies via `.metis.md` files give teams ways to enforce their standards.
Hardware vulnerability checks are on the roadmap through ecosystem collaboration. As silicon, software, and AI models intertwine, isolated scanning no longer suffices. Metis offers one path forward. Clone the repo, set an API key, index a codebase, and run a review. The docs walk you through it.
Source: Webpronews