OpenAI’s New AI Program Can Find Bugs In Our Code

On June 22nd, OpenAI and cybersecurity company Trail of Bits announced the launch of ‘Patch the Planet’. This effort aims to use AI to proactively identify vulnerabilities in open source software and help maintainers address them. Codex Security, OpenAI’s model trained to identify security issues in code, will be used to conduct these scans.

This is not an automatic process, however. Security engineers at Trail of Bits will utilize Codex Security to scan open source codebases, and manually vet each result prior to sharing with the maintainers of a project. These engineers will collaborate with maintainers to create patches and tests that ensure this type of issue won’t happen again. Additionally, they will develop repeatable processes that allow other projects to automatically detect similar bugs in the future.

The concept of ‘not adding to the burden’ is important here. Maintainers of open source projects are often overwhelmed with poor quality automated security reports. Volunteers maintaining popular libraries on the side don’t want yet another inbox filled with raw scanner results; they want someone to bring them solutions. Patch the Planet takes this into account.

1Why this matters for every builder

Whether you’re building a web application, an API, or an AI powered service, there’s a good chance you’re relying on some open source libraries written by others that you never look at. Whether it’s authentication, encryption, parsing, or making HTTP requests, these functions may very well be handled by someone’s side project. In 2021, a critical vulnerability was discovered in Log4j, a popular Java logging utility. As a result, hundreds of millions of devices were put at risk across the globe. This vulnerability had been hiding in the codebase for years.

Ignoring this problem doesn’t make it go away. If there’s a vulnerability in a library you’re using, there’s a vulnerability in your software. Your customers are now at risk. While Patch the Planet isn’t a silver bullet, it does help. With AI, we can scan entire codebases in the time it takes a human to examine the first few files, identifying commonalities and edge cases that might be missed after the sixth hour of reviewing. We can use AI to help us write code — and also to help us review the code we already have.