Security capability experiment
Static Analysis for AI-Generated Code
A Rust static-analysis tool focused on AI-generated and AI-application code patterns. It combines tree-sitter parsing, source-controlled rules, SARIF output, command-line and editor surfaces, and optional model-assisted triage.
Business ↔ technology bridge · Security capability experiment
Explores deterministic security analysis for AI-generated and AI-application code.
This is a portfolio and source interpretation—not a customer, deployment, certification, or outcome claim.
AI-assisted development can increase code volume and repeat insecure patterns faster than conventional review capacity grows.
Keep deterministic parsing and source-controlled rules primary, with model-assisted triage optional and explicitly separate.
Rust crates, tree-sitter parsers, YAML rules, SARIF output, CLI, LSP, CI integration, and selected fixtures.
Findings and unresolved uncertainty return to remediation priority, release criteria, security review, and engineering policy.
Source evidence
A Rust static-analysis tool focused on AI-generated and AI-application code patterns. It combines tree-sitter parsing, source-controlled rules, SARIF output, command-line and editor surfaces, and optional model-assisted triage.
Repository evidence is not client, deployment, certification, or outcome evidence.
Architecture
Three layers: CLI and CI integration, a 210-rule AST scanner for selected AI-generated and AI-application patterns, and optional model-assisted triage that can help rank findings. None of them replaces security review.
Source map only: a layer can represent implemented code, an adapter boundary, or documented design. It does not assert a configured production service.
Rust command-line, LSP, CI, and SARIF surfaces support local and review-workflow scans. No universal runtime or scale performance is asserted.
AST scanners for Python, TypeScript, JavaScript, Go. Five rule categories: vibe-code patterns, agent-security (tool definitions, capability sprawl), LLM application risks (prompt injection, unsanitised output), framework vulnerabilities, cloud misconfigurations. General-purpose scanners and these rules cover different surfaces.
Optional triage with a Mistral model, local or hosted, can help filter likely false positives and re-rank findings by context. It runs only when enabled and does not replace security review.
The Problem
Why AI-generated code is a security risk
AI assistants generate code faster than humans can review it. Vibe coding — accepting AI suggestions with minimal scrutiny — is the new normal.
AI optimises for working code, not secure code. The same hardcoded secret, the same SQL concatenation, the same permissive CORS — repeated across thousands of projects.
General-purpose scanners and AI-focused rules cover different surfaces. Prompt templates, agent tools, and model-output handling benefit from dedicated checks alongside existing SAST.
Agents can be granted file, database, network, or shell capabilities. Their permission boundaries and tool inputs need review beyond conventional application-code checks.
Rules
210 rules targeting five AI-specific vulnerability domains
Source scope only: an entry can describe implemented code, a documented adapter, or a configured workflow. It is not a statement that a production service is active.
01
40 rules for patterns commonly generated by AI coding assistants: hardcoded secrets in prompts, SQL injection via concatenation, dangerous code execution, insecure defaults, missing authentication, path traversal, insecure deserialization, and weak cryptography.
02
30 rules for autonomous agent code: overly permissive tool definitions, unrestricted file system access, shell command execution from user input, missing audit logging, no confirmation before destructive actions, unsafe inter-agent communication, and privilege escalation vectors.
03
40 rules for production LLM applications: raw user input in system prompts, unsanitized HTML rendering, LLM-generated SQL execution, exposed API keys, missing prompt injection detection, insecure OAuth flows, deprecated SDK usage, unvalidated tool outputs, and training data exfiltration risks.
04
50 rules across 10 frameworks: Express.js, Django, Flask, FastAPI, Spring Boot, Laravel, Rails, Next.js, NestJS, and Gin — covering debug mode exposure, missing auth guards, CORS wildcards, mass assignment, unvalidated DTOs, and actuator endpoint leaks.
05
50 rules across 7 platforms: AWS (15), Terraform (10), Kubernetes (6), GitHub Actions (5), GCP (5), Azure (5), Docker (4) — covering IAM over-permission, public buckets, disabled encryption, privileged containers, unpinned Actions, and misconfigured security groups.
06
Write custom rules in YAML — no Rust knowledge required. Define AST node types, regex patterns, ancestor context constraints, and fix suggestions. Scaffold new rules with a single command.
07
Native SARIF v2.1.0 output for GitHub Security tab integration. Findings appear as inline PR annotations with severity, fix suggestions, and references. Also supports JSON and text output.
08
Optional triage with Mistral AI or local Ollama models can help filter likely false positives, re-rank findings by context and suggest fixes. It is enabled with the --ai flag and does not replace security review.
09
An LSP surface provides diagnostics and selected code actions to compatible editors. Editor behaviour and rule coverage should be validated in the target workflow.
10
The repository includes a GitHub Action and command-line integration path for CI. Other pipeline integrations require operator configuration and validation.
210 rules across 5 categories
Deterministic rules identify selected AI-application patterns; optional model-assisted triage can help rank findings, but neither path replaces security review.
Repository surface only: availability, completeness, performance, and operational fitness require separate validation.
Hardcoded API keys in prompt templates, SQL via string concat in 'just demo' code paths, unsafe deserialisation, eval of LLM output, secrets logged at INFO. The cluster of patterns that ship when 'works once' beats 'works safely.'
Tool definitions with no parameter validation, agent capabilities that overlap with admin privileges, missing rate limits on LLM-callable tools, prompt prefixes that leak system identity. The cluster that lets a jailbreak turn into an incident.
Unsanitised LLM output rendered as HTML, prompt-injection vectors in user-controlled context, indirect injection via retrieved docs, model-output piped into shell or eval, missing output schema validation. The OWASP-LLM-Top-10 made concrete.
Next.js Server Action exposure without auth, FastAPI dependency injection bypass, LangChain chain-of-thought leakage, Django ORM SQL injection via raw(), unsafe template render. Per-framework rules, not generic taint-tracking.
Public S3 with sensitive prefixes, IAM roles with `*` actions, AWS Bedrock cross-account permissions, GCP Vertex AI exposed in a service-account-less context. The cluster that lets a leaked endpoint URL turn into a full data exfiltration.
Tech Stack
Named technologies identify repository dependencies or adapter surfaces; they do not assert a live integration or deployment.
Source Code
The Achilles AI source code is available upon request for evaluation and partnership purposes.
To access the source code, please sign our Non-Disclosure Agreement.
Need help securing AI-generated code in production? Our consulting services complement Achilles AI.
Twelve to twenty-four weeks to risk-classify your AI systems, support the provider-led conformity assessment and engineer the evidence, produce the Annex IV technical documentation, and stand up post-market monitoring — with special depth on the high-risk categories that apply to autonomous, industrial, and robotics deployments
Partnership
Whether you need AI code security auditing for your team or want to explore a partnership in the AppSec space.
From demo to dependable operation. Subscribe for new Physical AI reading.
Unsubscribe anytime. No spam, ever.