alt Hacker NewsIf not static analysis what would ai tools be considered? They're operating off the same source code
Also nice the onion reference by op.
Replies
wizzwizz4 • yesterday at 10:41 PM
It's a reference to Xe Iaso's blog (e.g. https://xeiaso.net/shitposts/no-way-to-prevent-this/CVE-2025...), which is itself a reference to The Onion.
➕ show 1 reply
"static analysis" is usually deterministic rules you can e.g. put in CI. AI is also somewhat dynamic in that it can execute commands to try stuff out. The best AI vuln finding harnesses work that way, by essentially putting the AI inside of a fuzzer-like environment and telling it to produce a crash.