Breaking AI: Live coding and hacking applications with Generative AI
summary
Live code builds a Spring Boot coffee-shop app with GitHub Copilot and ChatGPT, then deliberately weaponizes the generated output: Copilot produces a raw SQL string that tests as a SQL injection (demo updates all prices to zero), an upload handler allows directory traversal via ../ filenames, and product rendering exposes both reflective and stored XSS from unsanitized name/description. Scanners and a PR pipeline flag issues; switching to parameterized queries / prepared statements and path normalization fixes the exploits. Cited numbers: ~40% of Copilot code has vulnerabilities, 57% faster but 96% of teams already use AI tools.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:13Generative AI in development
- 4:04AI use cases for devs
- 7:19Risks of AI-generated code
- 10:55AI code security incidents
- 13:03Intellectual property concerns
- 15:32Live coding demo
- 17:01Building homepage with AI
- 18:04Adding search with AI
- 21:21SQL injection from AI code
- 23:27Fixing SQL injection
- 25:54Adding profile upload with AI
- 27:38Path traversal in file upload
- 30:11Exploiting path traversal
- 33:02Cross-site scripting vulnerabilities from AI
- 35:32AI limits in security
- 37:16Security scanners with AI
- 39:14AI amplifies code problems
- 42:04Secure AI development
- 45:17Takeaways and closing remarks
related talks
44mBreaking AI: Live Coding and Hacking Applications with Generative AI
46mBreaking AI: Live coding and hacking applicattions with Generative AI
31mHacking AI Applications
30mWhat Are the Security Risks Associated with AI-Generated Code? 🤔
28mAI-Generated Code: Unmasking the Security Pitfalls
01h 02mPANEL - Unleashing the Future: The Impact of Gen AI on Development Productivity
58mSecuring Code in the Age of AI
56mPANEL: Unleashing the Future: The Impact of Gen AI on Development Productivity