Breaking AI: Live Coding and Hacking Applications with Generative AI
summary
Live codes a Spring Boot + Spring Security + Thymeleaf app using Copilot and ChatGPT, produces working endpoints that initially contain glaring flaws, and demonstrates exploitation with Burp Suite: a concatenated query allows SQL injection, output enables XSS, and file uploads permit path traversal. A Snyk scan flags issues immediately, fixes include named query parameters to block injection and path normalization to stop traversal, and the talk cites the striking claim that about 40% vulnerable code appears in Copilot outputs. SQL injection and path traversal are proven and patched live.
AI-written summary · about
chapters (9)
- 0:00Introduction and background
- 2:02AI in development and security
- 11:54LLMs generating insecure code
- 17:59Building the conference app
- 22:56Adding search functionality
- 27:33Fixing SQL injection vulnerability
- 31:46Implementing profile uploads
- 36:30Path traversal vulnerability
- 41:28Takeaways and closing
related talks
46mBreaking AI: Live coding and hacking applications with Generative AI
46mBreaking AI: Live coding and hacking applicattions with Generative AI
28mAI-Generated Code: Unmasking the Security Pitfalls
31mHacking AI Applications
30mWhat Are the Security Risks Associated with AI-Generated Code? 🤔
54mA Practical Guide to AI Threats & Mitigation Strategies
33mAgentic ProbLLMs: Exploiting AI Computer-Use and Coding Agents
01h 14mBreaking the Bot: GenAI Web App Attack Surface & Exploitation