AI-assisted vulnerability discovery
Fuzzers and static analysis tools find possible bugs. AI can help point them in the right direction and sort the results, but people confirm and report responsibly.
In 60 seconds
AI-assisted vulnerability discovery
Fuzzers and static analysis tools find possible bugs. AI can help point them in the right direction and sort the results, but people confirm and report responsibly.
The main tools
| Method | What it does | How AI can help |
|---|---|---|
| Static analysis (SAST) | Reads source code to find risky patterns without running it | Explains findings, filters likely false positives, suggests fixes |
| Fuzzing | Sends many unusual or random inputs to a program to make it crash or misbehave | Writes fuzz harnesses (small test programs) and suggests interesting inputs |
| Dependency scanning | Checks libraries against known vulnerabilities | Summarises which findings affect code you really use |
| Manual review | An expert reads the code and design | Explains unfamiliar code and suggests where to look |
Triaging scanner output
- 1
Group
Merge duplicate findings from the same root cause. - 2
Explain
Ask AI what each finding means and how data reaches the risky line. - 3
Check reachability
Can outside input actually reach this code? Is it used at all? - 4
Confirm
Reproduce with a safe test in your own environment. - 5
Prioritise
Fix what is real, reachable and high impact first.
Responsible disclosure
- Scanning a company's website "just to check"
- Posting a bug publicly before the maintainer can fix it
- Submitting AI-generated bug reports without checking them
- Testing only what you own or are authorised to test
- Reporting privately through the project's security contact
- Reproducing and clearly describing the issue yourself before reporting
Watch and read more
Lab
A triaged list of made-up scanner findings with reasons and priorities.
The problem
Below are fictional scanner findings from your own practice project. Work only on paper or in your own editor.
- For each finding, ask an AI to explain it in simple words.
- Using the notes, decide: likely real, likely false positive, or needs more checking. Write your reason.
- Put the real ones in priority order.
- Write a short private disclosure note for the top finding, as if the project belonged to someone else: what, where, impact, how to reproduce safely, and a suggested fix.
F1 SQL built from string app/orders.py:42 note: value comes from URL parameter "order_id"
F2 Hard-coded password tests/fixtures.py:8 note: file used only in unit tests, fake value
F3 Weak hash (MD5) app/cache.py:15 note: used to name cache files, not for passwords
F4 Missing auth check app/admin.py:77 note: route /admin/export has no login decorator
F5 Outdated library requirements.txt note: known issue is in a feature the app does not importYou are done when
Hard questions
Try to answer before you reveal. If you can answer these, you understood the lesson.
Q1F5 is "not reachable" today. Why might you still upgrade the library?Reveal
Code changes. A future feature could start using the vulnerable part, and nobody may remember the old finding. Upgrades also make future patches easier. It is lower priority than F1 and F4, but it should be tracked, not forgotten.
Q2Why is an AI system that finds bugs automatically both good and risky for defenders?Reveal
Good, because it can help defenders find and fix bugs faster. Risky, because attackers can use similar methods, and because false reports can flood maintainers. The advantage goes to teams that combine it with quick fixing, careful checking and responsible disclosure.
Questions people ask
What is a false positive in scanning?
A finding that looks like a vulnerability but is not one in practice, for example because the input is already checked, or the code is never reachable. Scanners are designed to be cautious, so they often report these.
What is a fuzz harness?
A small piece of code that takes input from the fuzzer and passes it to the function you want to test. Writing harnesses is slow work, and AI can help draft them. You still check that the harness tests the right thing.
Can AI find bugs that tools miss?
Sometimes it notices logic problems that pattern-based scanners miss, such as a missing permission check. It also misses many bugs and reports some that do not exist. It works best combined with tools and human review.
Is bug bounty hunting legal?
Yes, when you follow the programme's written rules and scope. Testing anything outside that scope, or without a programme or permission, is not allowed.
Lesson test
5 questions. Get 3 right (60%) to pass and complete this lesson.