Arm Open-Sources Metis, AI-Powered Security Framework Delivering 10x Better Vulnerability Detection

Summary

Arm's product security team has developed and open-sourced Metis, an agentic AI security framework designed to detect complex security vulnerabilities across large-scale codebases. Built on a retrieval-augmented generation (RAG) architecture, Metis combines OpenAI's GPT-5.5-Cyber model with project-specific context from source code, build files, and documentation to deliver contextual security analysis that significantly outperforms traditional static analysis tools.

Internal benchmarks show Metis achieves up to 10x higher true positive rates and approximately 50% fewer false positives compared to leading static analysis tools. This substantial improvement in detection quality and reduction in false alarms helps engineering teams focus on genuine security issues, reducing wasted effort in validation cycles and accelerating vulnerability remediation.

Arm has already deployed Metis across more than 130 software projects internally, with plans for company-wide adoption by late 2026. By open-sourcing the framework, Arm aims to democratize access to advanced AI-powered security analysis across the industry, enabling engineering teams to detect sophisticated vulnerabilities earlier in development and improve overall product security.

• Metis is now open-sourced and available to the broader industry, supporting C, C++, Python, Rust, and other programming languages