Comment by verdverm
1 day ago
The way the bots fundamentally work means that we can never trust their output. We have ample cases at work where bots catch human mistakes and humans catch bot mistakes. The important aspect here is not completely handing things over to the bots.
> I wouldn't be surprised if it's zero times.
Statements like this concern me.
If you're so concerned you can create such a benchmark and show us all how wrong my guess is.
Instead I mostly read such opinions based on active imagination and no concrete experience with using AI for such work in a setup as described.
I suspect you would disregard or find fault in any benchmark I or others provide you.
Alternatively, if you want to see a benchmark so badly, you can create such a benchmark for your guess. I would imagine you would have more faith in the results of your own work.
If someone were to genuinely tell me that with the two SOTA models with the review step, severe security issues were left in the code, I would believe it.
That's not what anyone tells me though. I only hear theorizing and vague references to how AI failed people.
You're spot on that the thing I trust most is my own experience. I'm mostly working on mobile apps, my project does not have user accounts, so I couldn't tell you about authentication.
However, it is my experience that these models got very good at catching high-priority issues if you use the review step as I described.
Thus I theorize that SOTA models are likely to produce secure implementations.
5 replies →