AI assistants are writing C sooner than anybody can evaluation it, however SAST scanners which were used to catch bugs like integer and buffer overflows have struggled with C code.
Endor Labs’ AI SAST scans run sooner than build-based SAST scans, and in accordance with checks it has run, AI SAST caught 96 of 102 recognized vulnerabilities in 4 embedded C tasks, which was 48 occasions the following finest buildless pattern-based SAST instrument, the corporate wrote. Endor’s instrument isn’t primarily based on patterns however quite it makes use of AI to motive in regards to the code as a safety engineer would, and the corporate mentioned it outperformed 4 SAST instruments and frontier fashions Claude and Codex in benchmark trials.
As Endor defined, “the hole comes all the way down to how the 2 normal approaches work, and every one fails the alternative method. A frontier mannequin pointed at a repo causes nicely in regards to the code it reads, but it surely solely reads a slice. A sample scanner reads each file however causes about none of them, so it flags what code resembles quite than what it does, and buries you in false positives. AI SAST pairs deterministic program evaluation (the identical call-graph and reachability engine we constructed for SCA) with LLM reasoning.”
This system evaluation maps the entire codebase and traces how information strikes by means of it; the fashions motive over that structured context as an alternative of uncooked textual content. You get protection a mannequin alone can’t attain, with much less of the noise a sample engine can’t assist (see the whitepaper for extra particulars on how AI SAST works).
The way it handles what patterns can’t
We beforehand outlined the 4 structural causes C breaks static evaluation. Right here’s how AI SAST solutions every.
- The analyzer by no means sees the code you wrote. Macros, #ifdefs, and per-config builds imply the code a standard instrument analyzes isn’t the code on disk, which is why these instruments hook the compiler to reconstruct it. AI SAST reads and causes in regards to the supply instantly, so it doesn’t rely upon reproducing one actual construct to see what’s there.
- Pointers defeat dataflow evaluation. As an alternative of over-approximating into noise or under-approximating into missed bugs, AI SAST follows the info throughout capabilities and information and works out whether or not the size examine three capabilities upstream truly bounds this copy. That’s the query that issues in C, and the one a rule can’t reply.
- C’s bugs don’t match sample guidelines. Buffer overflows, use-after-free, integer overflows that feed an allocation dimension: these are about lengths, lifetimes, and arithmetic spanning capabilities, not the source-to-sink shapes a rule engine expresses nicely. AI SAST catches each the traditional memory-safety bugs and the cross-function flaws that allow an attacker take over the system.
- There’s no framework to mannequin. Each C codebase has its personal allocators, string dealing with, and possession conventions. AI SAST reads how your code truly manages reminiscence quite than leaning on generic guidelines that miss what’s harmful in your code and flag what isn’t.
Each discovering comes with the identical proof it does in each different language: a name path, a working exploit, and a urged repair.
The place it matches
AI SAST runs the place C will get written, not as a gate on the finish. A developer scans domestically to examine AI-generated C as they write it, and the identical evaluation runs on the pull request, so new flaws get discovered and glued earlier than they attain manufacturing as an alternative of piling right into a backlog. That retains safety in keeping with AI-accelerated growth as an alternative of turning evaluation into the bottleneck.
C SAST pairs with C SCA in the identical platform, so your first-party C and the open supply it is determined by are coated collectively. Each run on AURI by Endor Labs, our safety harness for the agentic SDLC: an unbiased layer exterior the coding agent (the mannequin writing the code isn’t the one factor reviewing it), verifiable findings with function-level name paths and reproducible proof, and coverage you set as soon as and implement throughout any agent, mannequin, or CI stage.
The subsequent C file an agent edits was most likely written earlier than anybody in your group joined, and the agent will faithfully reproduce no matter habits it finds there. That’s the code this was constructed to evaluation, whereas the PR continues to be open.
