youtube
When Vibes Don’t Build: Why Auto-Fixing Vulnerable Code Needs More Than Good Intentions - Spyros Gasteratos
This talk was recorded at NDC Manchester in Manchester, England.
#ndcmanchester #ndcconferences #developer #softwaredeveloper
Attend the next NDC conference near you:
Subscribe to our YouTube channel and learn every day:
/ @NDC
Follow our Social Media!
#applicationsecurity #security
"Developers deal with a lot of noise, why don't we use AI to fix some security bugs?" These were famous last words before we tried to use LLMs to fix potential vulnerabilities on our codebase.
The AI’s hilarious fix? Delete the function. Problem solved.
In this talk, I’ll share our failures and successes in building an agentic auto-remediation suggestion system for code vulnerabilities. We'll talk about how we threw everything at it: zero-shot classifiers, tree of thought prompting and reflexion loops. The AI responded by suggesting 200-line refactors for SQL injections or marking serious vulnerabilities as “false positives.”
Turns out, RAG and prompting aren’t enough. We needed constraint-based action planning, feedback loops from real developer behavior, and multi-agent workflows that argued with each other before touching code.
This is a story of over-engineering, humbling failures, and finally, a path to practical AI-assisted remediation that developers actually trust. You’ll laugh, cringe, and leave with a clear understanding of what it takes (and wha
|
2026/01/29
youtube
