Arm Opens Up AI Tool That Hunts Down Hidden Code Flaws

Arm has released a new weapon for developers drowning in complex codebases. On May 28, the chip designer made Metis open source—an AI framework trained to find security bugs that traditional scanners miss.

The tool, built by Arm’s own product security team, already checks over 130 of the company’s internal software projects. Full adoption across Arm is expected by late 2026. But starting today, anyone can grab the code from GitHub under an Apache 2.0 license.

Metis uses a technique called retrieval-augmented generation. It builds a custom knowledge base from source code, build files, and documentation, then lets large language models reason over that context. Unlike rule-based scanners that just match patterns, Metis tries to understand what the code is supposed to do.

The results from Arm’s internal tests are striking. The tool found up to 10 times more real vulnerabilities and cut false positives by about 50 percent compared to leading static analysis tools. In one benchmark, Metis caught 98 percent of known vulnerabilities across 352 firmware and driver samples. Traditional SAST tools managed just 6 percent.

Arm’s senior vice president of software, Mark Hambleton, said modern software stretches across so many layers—frameworks, runtimes, libraries—that static analysis hits its limits. Metis was designed to bridge that gap.

The system can review entire repositories, single files, pull requests, or recent changes. It builds evidence chains and explains why something matters. Developers get clear reports with suggested fixes. One example in the documentation shows it catching a memory remapping loop that forgets to write back changes.

Metis supports C, C++, Python, Rust, Go, TypeScript, Solidity, Verilog, and more. A plugin system makes it easy to add new languages. Teams can configure everything through YAML files—choose their LLM provider, adjust prompts, or switch between vector stores like ChromaDB and PostgreSQL. Docker images simplify deployment, and the command-line interface works in CI pipelines.

Arm positioned the release as a contribution to the industry. Security problems don’t stop at one company’s walls. Early interest has come from partners eager to test Metis in their own workflows. The project recently added Verilog support, and hardware vulnerability checks are on the roadmap.

Of course, the tool has limits. LLM hallucinations can still happen, even with strong retrieval. Arm stresses that Metis augments engineers, not replaces them. Findings still need human review.

Still, for the daily grind of code review at scale, Metis gives teams a smarter assistant. One that reasons, not just matches patterns.