AI tooling for static analysis mostly leaves the analyzer as the oracle and works around it: authoring rules, triaging findings, proposing the fix.
Static analysis and linters¶
Copilot Autofix suggests fixes for CodeQL findings; Semgrep Assistant authors rules and triages findings. Meta deployed automated program repair internally at scale: Getafix learns fix patterns from past human-written fixes and proposes fixes for static-analyzer warnings (Bader et al. 2019)1, and Sapfix patches null-dereference crashes that Sapienz tests reveal, augmenting mutation with patterns inferred from earlier human fixes (Marginean et al. 2019)2. Google's Big Sleep searches for vulnerabilities rather than repairing them, and it has found real CVEs in open-source code.
Clone detection¶
No AI-specific tool exists. A clone detector (jscpd, PMD CPD, Simian) is the oracle; a general-purpose agent consumes the report and proposes the de-duplication.
Dead-code detection¶
A detector (knip, Vulture) flags the candidates, but confirming a removal is safe needs a second oracle: the test suite plus whole-program reachability. No AI-specific dead-code tool exists; a general agent drives the detector and the suite.
References¶
-
Bader, Johannes, Andrew Scott, Michael Pradel, and Satish Chandra. 2019. "Getafix: Learning to Fix Bugs Automatically." Proceedings of the ACM on Programming Languages 3 (OOPSLA): 159:1–27. https://doi.org/10.1145/3360585. ↩
-
Marginean, Alexandru, Johannes Bader, Satish Chandra, et al. 2019. "SapFix: Automated End-to-End Repair at Scale." 2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP), 269–78. https://doi.org/10.1109/ICSE-SEIP.2019.00039. ↩