Finding 100+ Zero-Days in Open Source with AI Agents

Open source runs critical infrastructure, and most of it has no security team. AI ships code faster than anyone reviews it, and the gap between a bug landing and a bug being exploited keeps shrinking. In this talk, we cover the scanning architecture we use and the CLI we turned it into. The scanner runs agents that read code, follow imports, trace how functions call each other, and validate the findings to reduce false positives. The scanner is open source under Apache 2.0, and runs on any LLM. One in three of the projects we scanned had a real high or critical bug. We found over 100 zero-days, and we are disclosing them slowly as they get fixed. I walk through a few examples of why each bug happened, why it matters, how AI agents caught it, and why it would have been hard for a human to find.

About the Presenter: Philip Garabandic

Philip Garabandic is a Security Engineer at TikTok, previously at Amazon and AWS, with master’s degrees in Computer Science from Georgia Tech and Data Science from the University of London.

About the Presenter: Yuting Gu

Yuting Gu was a software engineer on AWS IAM Identity Center, with master’s degrees in Computer Science from Georgia Tech.