What the project is about
AI agents can inspect code, propose changes, and run tests as part of secure software development and operations (DevSecOps). However, a suggested security fix may leave the original vulnerability unresolved or introduce errors. Developers therefore need evidence to determine whether the resulting code is trustworthy.
This thesis will investigate how to assess security fixes produced by an existing AI coding agent. Trustworthiness will be examined through two concrete properties: whether the fix addresses the targeted vulnerability and whether the software retains its intended functionality.
Research focus and approach
The main research question is: How effectively can automated checks identify inadequate security fixes produced by an AI coding agent?
The student will:
- Review relevant research on evaluating AI-generated code and vulnerability repairs.
- Select a small collection of publicly available, reproducible vulnerable code examples in one programming language, covering one or two vulnerability types.
- Design and implement a small, self-contained experimental setup in which an existing AI agent inspects code, attempts repairs, and runs tests.
- Assess the proposed fixes using functional tests, targeted security tests, and static analysis, with repeated runs to examine consistency.
- Compare the findings with a reference assessment based on manual inspection and independently prepared tests, identifying missed problems and false alarms.
The project will focus on one agent configuration and a limited set of examples. The student will build the experimental setup using existing models and tools. No model training or access to an industrial DevSecOps environment is required.
Expected results and learning outcomes
Expected results include a lightweight assessment procedure, a reproducible experimental setup, and empirical findings on the strengths and limitations of the selected checks/approach. The thesis should provide practical guidance on what evidence supports accepting a proposed fix and when further human review is needed.
The student will gain experience in agentic AI, software security testing, experimental design, and critical evaluation of AI-generated outputs.
Qualifications
An interest in cybersecurity and AI, good programming skills, and basic knowledge of software testing and version control. Familiarity with language models or DevSecOps is useful but not required.
Contact:
Gencer Erdogan
Email: gencer.erdogan@sintef.no / gencere@ifi.uio.no