AI Security Scanners Can Be Fooled by Harmless Code Edits

Companies increasingly lean on AI to hunt for security bugs in software — the kind of weakness hackers use to break in and steal data. The idea is simple: feed the code to a model, and it flags the risky parts. But a new study from researchers at the University of Waterloo shows that these models are far shakier than they look.

The problem is that these tools don't really read code the way a human does. They turn it into a long list of numbers — a kind of mathematical fingerprint — and then decide 'dangerous' or 'fine' based on that fingerprint. Harmless edits scramble the fingerprint. Deleting a comment, renaming a variable, adding code that never runs, or rewriting a loop can push a genuinely vulnerable function across the line into the 'safe' pile. Testing 15,000 C/C++ functions, the researchers found that under a combination of these edits, between 35% and 42% of correctly detected vulnerabilities flipped to 'benign.'

That matters because real developers do exactly these things every day. A security scan run on Monday and again on Friday — after routine cleanup — can give completely different answers about the same code. Someone could ship a known flaw believing it was cleared.

The team also built a defence. By training the model to keep the original and the edited version of a function close together in its internal number-space, they cut the average flip rate from 22.6% to 11.3%. That's real progress, but it comes with a catch: the model started flagging more safe code as dangerous, creating extra false alarms that waste developers' time. And it doesn't fully solve the instability.

The takeaway isn't that AI code scanners are useless — it's that they should be a first pass, not the final word. Especially for anything touching passwords, payments, or personal data.