Comment by synarchefriend
1 hour ago
I would expect code written by the latest frontier models with a "find all security issues make no mistakes" pass to be more secure than average human code written in the pre-AI era (not a high bar).
1 hour ago
I would expect code written by the latest frontier models with a "find all security issues make no mistakes" pass to be more secure than average human code written in the pre-AI era (not a high bar).
I would expect it depends on the language. Less unchecked memcpy, more forgetting to check the user is an admin.
> I would expect code written by the latest frontier models with a "find all security issues make no mistakes" pass to be more secure than average human code written in the pre-AI era (not a high bar).
"If you write code as cleverly as you can, you are, by definition, too stupid to debug it."
Do you disagree with this? Because if you don't, then the rate of bugs/RCEs in a completely AI-written-software world will be exactly the same as the rate of bugs in a completely human-written-software world.
A combination of human-authorship + AI-review, with absolutely no AI-written code is going to have the lowest rate of bugs, because there is always one entity who understands the code (because they wrote it) and one entity who is smarter than the author who can find bugs.
The AI-generated code I see from SOTA models is absolute spaghetti, and they start running into problems spotting bugs after even a small number of refinements/changes to the software (say, 50).
The problem with all this spaghetti is that they are quick to write something that even they can't easily read. Even mediocre but experienced humans are not so eager to write something that they can't easily debug.
IOW, for any non-trivial problem, with AI-generated code you are guaranteed to get spaghetti that it cannot understand. With humans, it's only a probability that that will happen.
A lot of people expect that. Apparently it's not working out so well in reality. My buddy who is big in this said something to the effect of, when a human codebase has human understanding it may have issues but it's strengthened by ai. When an ai codebase has little human understanding it's not strengthened by people very much. So his take was the most secure code bases he is seeing right now are human ones which use ai tools to help read and review rather then write. My guess is that's also cultural and industry specific. He is niched into businesses that actually care and usually doesn't take work from cowboy outfits.