One Thousand and One AI-Prevented CVEs: Vibe Coding a Whole New... (Brandon Wu)
summary
Pipeline combines a deterministic callgraph built with Semgrep static analysis and GitHub usage scraping with selective LLM research to auto‑generate tests and Semgrep rules, verify them per‑function, and stitch passing components together. System authors nearly 3,500 rules over two years, reduces researcher time roughly 40 percent on average, handles bursts like 50 CVEs in a night, and keeps a human reviewer in the loop for final validation.
AI-written summary · about
chapters (9)
- 0:00Introduction and setup
- 2:31Supply chain security challenges
- 8:48Max’s manual rule-writing workflow
- 16:30Automating rule generation with BRAT
- 22:24Code graphs and vulnerability detection
- 33:56Composable AI workflows
- 37:06BRAT’s results and impact
- 41:56AI vs deterministic workflows
- 43:24Q&A and conclusion
related talks
23mStopping vulnerabilities at the source
32mFrom Vibes to Outages: Riding the AI Code Wave
33mShipping Fast, Breaking Silently: Why AI-Generated Code Needs a Second Opinion
29mVibecoding Promise and Peril
25mAutomating Cyber Threat Intelligence: A Practical Approach to Managing Emerging Vulnerabilities
23mVibes Not Vulns: Securing the Era of AI-Written Software
38mCode Security Reinvented: Navigating the era of AI
35mKeynote: How I learned to stop worrying and love CVEs