Why Pattern-Matching Scanners Miss Structural Bugs (and What I Built Instead)

TL;DR Pattern-matching scanners (Semgrep, Snyk, CodeQL) find what their rulebook encodes. Bugs that arrive as structural variants — the sink is three calls away, the taint flows through an unusual shape, the CVE matters but the pattern doesn't match verbatim — slip through. I built mythos-agent , an open-source AI code reviewer (MIT, TypeScript, GitHub ), to layer an LLM-based hypothesis stage on top of a traditional SAST foundation. This post is the technical writeup: what the pipeline looks li