"AI is telling me there's an RCE vulnerability here, but how do I validate it?" This was one of the most common questions from participants at @secdim Vibe Coding Security workshop at @NDC_Conferences Oslo. The reality is that AI helps, but we are the gatekeepers. We make the call on the security of our software. Using some techniques, we can guide AI to find security weaknesses. Assurance can only come from us. A skilled developer knows insecure design patterns, understands AI blind spots, and has the hands-on skill to verify vulnerabilities. That last point was the key takeaway for participants. We ran the workshop in Oslo. The next one is in London on 25-26 January 2027 (seats are limited. link in the comments). #security #vibecoding #workshop

I always enjoy speaking at grassroots tech conferences, and this time here in Australia @PyConAU 🇦🇺. There is a misunderstanding among some that "AI has solved most of software security problem"! Rather than arguing with this opinion, in this talk, based on real data, I will show that this is wishful thinking, and where the root causes of software security vulnerabilities really are. Join me Friday. Ballroom 3, 10:45am. First cybersecurity talk of the conference. Also -> Voucher code for 10% off in comments. #appsec #securecoding #aisecurity #devsecops

Feedback loop security degradation: the more you run AI to "fix security", the worse the outcome will be after each iteration. This is interesting academic research. ~40% increase in critical vulnerabilities after just five iterations. Security-focused prompts still introduced new flaws — cryptographic implementation errors above everything else. Explicitly asking the model to "fix security" made things worse. The code looked more sophisticated each round. That's the trap. Developers trusted the output, reviewed less, and missed the flaws the model introduced. At @secdim , we see this also. Developers skip review because it is "too much to review". Those who do review miss the security flaws. The skill to critically evaluate AI-generated code is degrading. The research recommends mandatory human security code review and no more than three (3) consecutive LLM iterations. Paper in comments. #aisecurity #appsec