Why AI Code Passes OWASP but Fails MISRA
summary
Explains why identical C++ snippets can be accepted by one standard and rejected by another because standards have different goals and decidability requirements. Shows that MISRA bans C-style casts while OWASP ASVS provides 286 testable security requirements and Sonar Way emphasizes actionable, educative rules. Uses static analysis distinctions between decidable vs undecidable rules and cites a study finding up to 20% of AI-introduced package names don’t exist (supply chain squatting). Concludes AI increases frequency of human-like mistakes and raises new dependency and architecture risks.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:17Rules, Standards, and Why They Matter
- 0:50From Writing Rules to Managing Standards
- 1:11What “Standards” Really Cover
- 2:09How Standards Differ in Scope and Strictness
- 4:41OWASP ASVS: Security Standards as a Contract
- 6:04MISRA: Safe Subsets of C++ for Critical Systems
- 8:22Sonar Way: Actionable Code Health Rules
- 9:37Rules as Tools, Not Absolute Truth
- 12:18One Cast, Three Different Standards
- 13:58What AI Changes — and What It Doesn’t
- 15:23New Risks from AI-Generated Code
- 17:30Key Takeaways on Standards, Rules, and AI
related talks
01h 02mHow to deal with static analysis findings: MISRA
01h 20mSafer C++: MISRA-C++ : 202X Rules and Beyond
57mAI Applications Security Puzzle
28mScalable Security and Compliance in the Age of AI
14mDesigning the open and safe AI future
33mShipping Fast, Breaking Silently: Why AI-Generated Code Needs a Second Opinion
39mBack to Basics: Cutting Through the AI-Generated Code Noise
50mAI Systems Are Software Systems