The analyzer stays the oracle in every entry here, and AI works around it: authoring rules, triaging findings, proposing the fix. The field moves quickly, and these entries may be out of date.
Static analysis and linters¶
Copilot Autofix suggests fixes for CodeQL findings; Semgrep Assistant authors rules and triages findings. The strongest evidence is from automated program repair deployed internally at scale: Meta's Sapfix (Marginean et al. 2019)1 and Getafix (Bader et al. 2019)2, which learn fix patterns from past edits. Google's Big Sleep searches for vulnerabilities rather than repairing them, and it has found real CVEs in open-source code.
Clone detection¶
No AI-specific tool exists. A clone detector (jscpd, PMD CPD, Simian) is the oracle; a general-purpose agent consumes the report and proposes the de-duplication.
Dead-code detection¶
A detector (knip, Vulture) flags the candidates, but confirming a removal is safe needs a second oracle: the test suite plus whole-program reachability. No AI-specific dead-code tool exists; a general agent drives the detector and the suite.
References¶
-
Marginean, Alexandru, Johannes Bader, Satish Chandra, et al. 2019. "SapFix: Automated End-to-End Repair at Scale." 2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP), 269–78. https://doi.org/10.1109/ICSE-SEIP.2019.00039. ↩
-
Bader, Johannes, Andrew Scott, Michael Pradel, and Satish Chandra. 2019. "Getafix: Learning to Fix Bugs Automatically." Proceedings of the ACM on Programming Languages 3 (OOPSLA): 159:1–27. https://doi.org/10.1145/3360585. ↩