One-Click Code Fix: Securing Code Using AI
summary
Demonstrates an internal pipeline that uses GPT-4 with zero/single/few-shot prompts and a chain-of-thought prompt pattern to auto-generate fixes, targeting mostly same-file injection bugs; a Slack agent and CLI agent create PRs (demo shows ~25 seconds to PR). Finds high false positives when scanning whole repos, Hallucinations unless output schema and library imports are explicit, and complex cross-file bugs fail. Evaluation uses a LangChain scoring evaluator against a golden dataset and keeps humans as final gatekeepers.
AI-written summary · about
chapters (14)
- 0:00Introduction to AI code fixes
- 1:05Traditional vulnerability detection
- 2:11AI approaches for finding vulnerabilities
- 3:14Traditional vulnerability fixes
- 4:18Why build your own AI solution
- 5:47Solution journey and challenges
- 7:55Zero-shot prompt engineering
- 9:22Single-shot and few-shot methods
- 11:51Chain of Thought method
- 13:37Limitations and reality check
- 15:42Metrics and evaluation
- 18:11Demo of AI code fixing
- 19:48Conclusions and takeaways
- 24:05Q&A session
related talks
56mWhy Auto-Fixing Vulnerable Code Needs More Than Good Intentions
59mUsing AI for Secure Code Creation: Enhancing Software Security
50mIdentifying and fixing Issues in Code using AI based tools
58mSecuring Code in the Age of AI
41mCode Security Reinvented Navigating the era of AI
01h 01m"Looks Good to Me": A Practical Guide to Handling AI-Generated Code
23mCode Security Reinvented Navigating the era of AI
22mAI, Make It So - A Dive into the Universe of Prompt Engineering