AI can spot zero‑day bugs yet still fails at writing secure code
| Source: Mastodon | Original article
AI can discover zero‑day vulnerabilities but still struggles to generate reliable secure code, according to a CSO Online article highlighted by 1Password's Off‑by‑1 Labs.
AI tools are proving adept at spotting software flaws, yet they still stumble when it comes to producing code that holds up under security scrutiny. 1Password’s Off‑by‑1 Labs, which has been probing AI’s capacity to generate viable security patches, points readers to a recent CSO Online analysis titled “AI can find zero‑days but still can’t reliably write secure code.” The piece draws on a year‑long series of Veracode assessments that examined more than 100 model versions across four study snapshots.
The findings are stark: while every model churned out syntactically correct code in 99 % of cases, the “security pass rate” – the proportion of submissions that met Veracode’s vulnerability standards – showed little improvement over the period. In other words, AI can locate zero‑day exploits faster than many human adversaries, but it cannot yet translate that insight into robust, production‑ready code without introducing new weaknesses.
Why this matters is twofold. First, the hype around AI‑driven development tools often glosses over the gap between speed and safety, potentially luring organizations into a false sense of security. Second, the persistent stylistic fingerprints of AI‑generated code, highlighted by parallel research on literary stylometry, suggest that automated output remains distinguishable and, more importantly, may carry predictable flaw patterns that attackers could exploit.
Looking ahead, the industry will be watching for any shift in the security pass metric as model architectures evolve and as firms like 1Password continue their hands‑on evaluations. Greater integration of human review, tighter prompt engineering, and targeted training on secure coding practices could narrow the gap. Until then, developers are advised to treat AI‑written code as a draft rather than a finished product, subjecting it to rigorous manual testing before deployment.
Sources
Back to AIPULSEN