Don’t Make This Mistake: Painful Learnings of Applying AI in Security
summary
Tested OpenAI (GPT‑3) on two apps (Juice Shop, WebGoat) with ~100+ scanner findings: 29% solved with workable fixes, 19% partial or nonbreaking fixes, and 52% hallucinated or broke the app or introduced new vulnerabilities. Fixes often change unrelated code or assume incorrect types. Deterministic AST/pattern fixes are reliable but slow to build; best approach combines narrow prompts, RAG for context, and automated validation of syntax and security before applying any patch.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 2:51DevSecOps failure in security
- 4:15Security tech debt problem
- 6:00Goals for security vulnerabilities
- 7:46Measuring security success
- 8:09AI for vulnerability fixes attempt
- 11:03AI limitations research
- 13:36AI risks live demo
- 16:30AI remediation challenges
- 17:33AI failure examples
- 20:01AI-based fixes evolution
- 23:12GitHub AI claims vs reality
- 24:36Why AI breaks apps
- 27:07Algorithmic approach without AI
- 28:52Parsing vulnerability challenges
- 30:34AI with deterministic algorithms
- 33:03AI role in security summary
- 34:29AI in security advice
- 34:50Q&A
related talks
52mUsing GenAI on and inside your code, what could possibly go wrong?
55mUsing GenAI on and inside your code, what could possibly go wrong?
12mTrusting AI with Code: How Secure is AI-written code?
57mAI Applications Security Puzzle
53mHow to Break AI Systems (Before Someone Else Does)
46mBreaking AI: Live coding and hacking applications with Generative AI
29mOne-Click Code Fix: Securing Code Using AI
31mHacking AI Applications