“A lot of security vulnerabilities in application code have similar shapes, and they're very hyper local usually. The ones that are tough to catch are state across time or state across threads. Those are really hard for humans because we just don't think that way. And the agents are really good at being like, oh, this is a thing that could happen.”
sputnikintelligence.com
Kamran had said he now uses AI agents to security-review his own app. Erik explains why agents suit this: the bugs humans miss most are about timing and concurrency, which pattern-matching agents are good at spotting.
…the PHP right now. So like I don't envy them. So all of the eyes are drawn there because everyone's looking now, looking for similar things. So if you had like one type of problem somewhere, odds are there's more. So that's what security researchers like to do. Yeah. Just like they start looking.
…a really obvious kind of issue. But the thing is, is that it's not just your code. It's all your dependencies too. Right. So like .NET, when the .NET security update came out this week, I immediately rebuilt all my images to get the latest runtime because the runtime patches the Brotley problem.
Yep. And this is another area where I think agents are going to be super useful. And that's this code review static analysis space where because it's pattern matching activity and a lot of security vulnerabilities in at least an application code have similar shapes. So it's really easy and they're very hyper local usually. I think the things that are tough to catch vulnerabilities that are state across time or state across threads. Those are still very hard. And agents do a great job about finding those. Those are really hard for humans because we just don't think that way. And the agents are really good at being like, oh, this is a thing that could happen. Right. You know, and it's weird pattern match. So like as far as like static analysis tooling for like security problems, I think it's extremely useful for finding stuff.
The thing that resonates with me in his post, well, first of all, he says like, it's sad, right? It's like, he's saying, when I was a kid, we called up BBSs, those bulletin board systems that were hosted in people's homes. When I was in high school, we downloaded music from public FTP addresses.…
And it's totally deterministic. And deterministic,
yes. I mean, I used Claude to Vibe code and build it, but once it's out there, I don't have to change it. Don't have to maintain it.