Can AI be used to see if something fishy was put into open source code?

K8y

I've heard people say there's too much code to review to see if someone put in something fishy, like a tracker, into open source software. It seems to me this would be a great way coders and developers can utilize and train AI to spot any odd modifications within a long string of code...

nologo

K8y I've heard people say there's too much code to review to see if someone put in something fishy, like a tracker, into open source software

I've heard people say the earth is flat.

K8y It seems to me this would be a great way coders and developers can utilize and train AI to spot any odd modifications within a long string of code...

I've heard people say AI is very good at detecting malware. Off course, those people work at AI companies and make a living creating AI hype. Strangely, they don't seem to talk about the possibily of AI generating and spreading malware much.

LeslieFH

Don't use LLMs (called "AI" by the marketing people) for anything you're not an expert at, because hallucinations are an inherent element of the LLM technology, and if you're not an expert, you're not going to spot the hallucinations.

Machine learning has its uses. "Giving unskilled people access to skills" isn't one of them.

vtek

Anthropic's AI Found Thousands of Zero-Days: What It Means for Your Website | Press Forge

Emphasis, mine...

The numbers are striking. In a matter of weeks, Mythos identified thousands of zero-day vulnerabilities, flaws that had been invisible to both human researchers and automated scanning tools. TechCrunch reported that the model found a 27-year-old remote crash vulnerability in OpenBSD, one of the most security-hardened systems in existence. It found a 16-year-old flaw in FFmpeg, the video library used by virtually every media application on the planet. Automated testing tools had hit that same code path five million times without catching it.

On the CyberGym benchmark for vulnerability reproduction, Mythos scored 83.1%, compared to 66.6% for Claude Opus 4.6. What sets it apart from previous AI security tools is its ability to chain individually minor flaws into exploitable attack sequences. In one test, it linked multiple Linux kernel vulnerabilities to escalate privileges from an ordinary user to full system control.