Why Auto-Fixing Vulnerable Code Needs More Than Good Intentions
summary
Built an agentic auto-remediation pipeline that initially zero-shot and n-shot prompts hallucinate (including deleting functions or suggesting 200-line refactors for SQL injection) and even mark real bugs as false positives. Success requires a knowledge graph, constraint-based action planning, CI/CD-driven reflection loops that compile/lint/run tests, and multi-agent critique before creating PRs. Training from scratch proves prohibitively expensive (GPT‑4 ~$100M, Gemini ~$200M; smaller models still cost hundreds of thousands), so practical fixes rely on targeted fine-tuning, integration, and human review.
AI-written summary · about
chapters (8)
- 0:00Auto-remediation challenges
- 29:43Developer trust and erosion
- 30:12Pitfalls of automation
- 30:37The cost of custom models
- 33:22Fine-tuning and its risks
- 36:21Data contamination concerns
- 47:53Hybrid AI architectures
- 49:23Q&A and final thoughts
related talks
29mOne-Click Code Fix: Securing Code Using AI
57mKeynote: Using LLMs and generative AI to fix software vulnerabilities
59mUsing AI for Secure Code Creation: Enhancing Software Security
30mTopics of Interest: Automatic Vulnerability Remediation: The Trusted and Secure Road ...
50mFrom Prompt Hacking to Architectural Determinism: Engineering Reliable GenAI Systems
44mFixing, not hunting: developing and deploying an AI assistant for vulnerability remediation
43mCracking the Code Review: from Guesswork to Automated Guidance
26mOrchestrating AI Agents for Large-Scale Refactoring