AI assistants are writing C sooner than anybody can assessment it, however SAST scanners which were used to catch bugs like integer and buffer overflows have struggled with C code.
Endor Labs’ AI SAST scans run sooner than build-based SAST scans, and in response to assessments it has run, AI SAST caught 96 of 102 identified vulnerabilities in 4 embedded C tasks, which was 48 occasions the subsequent greatest buildless pattern-based SAST software, the corporate wrote. Endor’s software shouldn’t be based mostly on patterns however quite it makes use of AI to cause concerning the code as a safety engineer would, and the corporate stated it outperformed 4 SAST instruments and frontier fashions Claude and Codex in benchmark trials.
As Endor defined, “the hole comes right down to how the 2 common approaches work, and each fails the alternative approach. A frontier mannequin pointed at a repo causes effectively concerning the code it reads, nevertheless it solely reads a slice. A sample scanner reads each file however causes about none of them, so it flags what code resembles quite than what it does, and buries you in false positives. AI SAST pairs deterministic program evaluation (the identical call-graph and reachability engine we constructed for SCA) with LLM reasoning.”
This system evaluation maps the entire codebase and traces how knowledge strikes by means of it; the fashions cause over that structured context as a substitute of uncooked textual content. You get protection a mannequin alone can’t attain, with much less of the noise a sample engine can’t assist (see the whitepaper for extra particulars on how AI SAST works).
The way it handles what patterns can’t
We beforehand outlined the 4 structural causes C breaks static evaluation. Right here’s how AI SAST solutions every.
- The analyzer by no means sees the code you wrote. Macros, #ifdefs, and per-config builds imply the code a standard software analyzes isn’t the code on disk, which is why these instruments hook the compiler to reconstruct it. AI SAST reads and causes concerning the supply instantly, so it doesn’t rely upon reproducing one actual construct to see what’s there.
- Pointers defeat dataflow evaluation. As a substitute of over-approximating into noise or under-approximating into missed bugs, AI SAST follows the information throughout capabilities and information and works out whether or not the size examine three capabilities upstream really bounds this copy. That’s the query that issues in C, and the one a rule can’t reply.
- C’s bugs don’t match sample guidelines. Buffer overflows, use-after-free, integer overflows that feed an allocation measurement: these are about lengths, lifetimes, and arithmetic spanning capabilities, not the source-to-sink shapes a rule engine expresses effectively. AI SAST catches each the basic memory-safety bugs and the cross-function flaws that allow an attacker take over the system.
- There’s no framework to mannequin. Each C codebase has its personal allocators, string dealing with, and possession conventions. AI SAST reads how your code really manages reminiscence quite than leaning on generic guidelines that miss what’s harmful in your code and flag what isn’t.
Each discovering comes with the identical proof it does in each different language: a name path, a working exploit, and a prompt repair.
The place it matches
AI SAST runs the place C will get written, not as a gate on the finish. A developer scans regionally to examine AI-generated C as they write it, and the identical evaluation runs on the pull request, so new flaws get discovered and glued earlier than they attain manufacturing as a substitute of piling right into a backlog. That retains safety consistent with AI-accelerated growth as a substitute of turning assessment into the bottleneck.
C SAST pairs with C SCA in the identical platform, so your first-party C and the open supply it is determined by are coated collectively. Each run on AURI by Endor Labs, our safety harness for the agentic SDLC: an impartial layer exterior the coding agent (the mannequin writing the code isn’t the one factor reviewing it), verifiable findings with function-level name paths and reproducible proof, and coverage you set as soon as and implement throughout any agent, mannequin, or CI stage.
The subsequent C file an agent edits was most likely written earlier than anybody in your workforce joined, and the agent will faithfully reproduce no matter habits it finds there. That’s the code this was constructed to assessment, whereas the PR continues to be open.
