Static Analysis for AI-Generated Code
A Rust static-analysis tool focused on AI-generated and AI-application code patterns. It combines tree-sitter parsing, source-controlled rules, SARIF output, command-line and editor surfaces, and optional model-assisted triage.
Public early release
Source through 2026-02-26
Inspectable artefacts
Explicit claim boundary
Source evidence
A Rust static-analysis tool focused on AI-generated and AI-application code patterns. It combines tree-sitter parsing, source-controlled rules, SARIF output, command-line and editor surfaces, and optional model-assisted triage.
Repository evidence is not client, deployment, certification, or outcome evidence.
The Problem
Why AI-generated code is a security risk
AI assistants generate code faster than humans can review it. Vibe coding — accepting AI suggestions with minimal scrutiny — is the new normal.
AI optimises for working code, not secure code. The same hardcoded secret, the same SQL concatenation, the same permissive CORS — repeated across thousands of projects.
General-purpose scanners and AI-focused rules cover different surfaces. Prompt templates, agent tools, and model-output handling benefit from dedicated checks alongside existing SAST.
Agents can be granted file, database, network, or shell capabilities. Their permission boundaries and tool inputs need review beyond conventional application-code checks.
Rules
210 rules targeting five AI-specific vulnerability domains
Source scope only: a card can describe implemented code, a documented adapter, or a configured workflow. It is not a statement that a production service is active.
40 rules for patterns commonly generated by AI coding assistants: hardcoded secrets in prompts, SQL injection via concatenation, dangerous code execution, insecure defaults, missing authentication, path traversal, insecure deserialization, and weak cryptography.
30 rules for autonomous agent code: overly permissive tool definitions, unrestricted file system access, shell command execution from user input, missing audit logging, no confirmation before destructive actions, unsafe inter-agent communication, and privilege escalation vectors.
40 rules for production LLM applications: raw user input in system prompts, unsanitized HTML rendering, LLM-generated SQL execution, exposed API keys, missing prompt injection detection, insecure OAuth flows, deprecated SDK usage, unvalidated tool outputs, and training data exfiltration risks.
50 rules across 10 frameworks: Express.js, Django, Flask, FastAPI, Spring Boot, Laravel, Rails, Next.js, NestJS, and Gin — covering debug mode exposure, missing auth guards, CORS wildcards, mass assignment, unvalidated DTOs, and actuator endpoint leaks.
50 rules across 7 platforms: AWS (15), Terraform (10), Kubernetes (6), GitHub Actions (5), GCP (5), Azure (5), Docker (4) — covering IAM over-permission, public buckets, disabled encryption, privileged containers, unpinned Actions, and misconfigured security groups.
Write custom rules in YAML — no Rust knowledge required. Define AST node types, regex patterns, ancestor context constraints, and fix suggestions. Scaffold new rules with a single command.
Native SARIF v2.1.0 output for GitHub Security tab integration. Findings appear as inline PR annotations with severity, fix suggestions, and references. Also supports JSON and text output.
Integrate Mistral AI or local Ollama models to reduce false positives, re-rank severity based on context, and generate contextual fix suggestions. Enable with a single --ai flag — works with any supported model.
An LSP surface provides diagnostics and selected code actions to compatible editors. Editor behaviour and rule coverage should be validated in the target workflow.
The repository includes a GitHub Action and command-line integration path for CI. Other pipeline integrations require operator configuration and validation.
Tech Stack
Named technologies identify repository dependencies or adapter surfaces; they do not assert a live integration or deployment.
Rust workspace: achilles-parsers, achilles-core, achilles-ai, achilles-lsp, achilles-cli — tree-sitter, serde, regex, YAML rule engine, taint flow analysis
tree-sitter-javascript, tree-sitter-typescript, tree-sitter-python, tree-sitter-go, tree-sitter-java, tree-sitter-rust, tree-sitter-ruby, tree-sitter-php, tree-sitter-c-sharp, tree-sitter-swift
Mistral AI SDK, Ollama client, configurable model selection, false-positive filtering, severity re-ranking
clap, coloured, serde_json, SARIF v2.1.0 output, Language Server Protocol
GitHub Actions (CI + cross-compile release), GitLab CI, Bitbucket Pipelines, pre-commit hooks
Linux (amd64/arm64), macOS (amd64/arm64), Windows (amd64), crates.io
Source Code
The Achilles AI source code is available upon request for evaluation and partnership purposes.
To access the source code, please sign our Non-Disclosure Agreement.
Need help securing AI-generated code in production? Our consulting services complement Achilles AI.
Twelve to twenty-four weeks to risk-classify your AI systems, support the provider-led conformity assessment and engineer the evidence, produce the Annex IV technical documentation, and stand up post-market monitoring — with special depth on the high-risk categories that apply to autonomous, industrial, and robotics deployments
Partnership
Whether you need AI code security auditing for your team or want to explore a partnership in the AppSec space.
Most AI pilots stall before production. Get the playbook for the ones that ship.
Unsubscribe anytime. No spam, ever.
Architecture
Three layers: drop-in CLI/CI integration, a 210-rule AST scanner tuned for AI-generated patterns, and an LLM-judged severity ranker that puts the real risks at the top.
Source map only: a layer can represent implemented code, an adapter boundary, or documented design. It does not assert a configured production service.
Rust command-line, LSP, CI, and SARIF surfaces support local and review-workflow scans. No universal runtime or scale performance is asserted.
AST scanners for Python, TypeScript, JavaScript, Go. Five rule categories: vibe-code patterns, agent-security (tool definitions, capability sprawl), LLM application risks (prompt injection, unsanitised output), framework vulnerabilities, cloud misconfigurations. The patterns SAST tools don't have.
LLM-judged scoring (Mistral local or hosted) re-ranks findings by exploitability against your stack. No more 500-finding reports nobody reads — the top 10 are actually the top 10, with a short explanation a developer can act on.
210 rules across 5 categories
Deterministic rules identify selected AI-application patterns; optional model-assisted triage can help rank findings, but neither path replaces security review.
Repository surface only: availability, completeness, performance, and operational fitness require separate validation.
47 RULESHardcoded API keys in prompt templates, SQL via string concat in 'just demo' code paths, unsafe deserialisation, eval of LLM output, secrets logged at INFO. The cluster of patterns that ship when 'works once' beats 'works safely.'
38 RULESTool definitions with no parameter validation, agent capabilities that overlap with admin privileges, missing rate limits on LLM-callable tools, prompt prefixes that leak system identity. The cluster that lets a jailbreak turn into an incident.
52 RULESUnsanitised LLM output rendered as HTML, prompt-injection vectors in user-controlled context, indirect injection via retrieved docs, model-output piped into shell or eval, missing output schema validation. The OWASP-LLM-Top-10 made concrete.
43 RULESNext.js Server Action exposure without auth, FastAPI dependency injection bypass, LangChain chain-of-thought leakage, Django ORM SQL injection via raw(), unsafe template render. Per-framework rules, not generic taint-tracking.
30 RULESPublic S3 with sensitive prefixes, IAM roles with `*` actions, AWS Bedrock cross-account permissions, GCP Vertex AI exposed in a service-account-less context. The cluster that lets a leaked endpoint URL turn into a full data exfiltration.