AI Can Fix Your Cloud Security Mistakes — But Only If You Double-Check

Most companies now run their websites and apps on rented cloud computers, and they set those computers up using text files — a practice called Infrastructure-as-Code, or IaC. Think of it as a recipe the cloud follows. When that recipe has a mistake — an unlocked storage bucket, an open door left ajar — attackers walk straight in. Cloud misconfigurations are one of the biggest causes of data breaches, and companies are now asking AI chatbots to spot and fix them.

A researcher named Lokesh Chauhan built a testing framework called IaC-Guard-V to find out whether those AI fixes can actually be trusted. He collected 70 real cloud setup files that security scanners had flagged, covering the two most common systems, Terraform and Kubernetes. Then he had three different AI models attempt repairs 630 times, grading each attempt on four things: does the code run at all, did it really fix the flagged problem, did it break anything else, and did it change more than necessary.

The results are both a warning and a promise. Every AI wrote code that ran without errors — 100% on that basic test. But when the AI got just one shot at fixing the problem, only 32% to 50% passed full inspection. Adding a checking loop, where the AI reviews its own work and tries again, lifted success to 68% to 92%. Notably, a free open-source AI using that checking loop beat the best paid commercial model working without it — at one-twelfth the cost per verified fix.

The catch: telling the AI to be more structured actually made Terraform repairs worse, contradicting a common belief that tighter instructions always help. This paper is also pre-peer-review, and the testing covered 70 files — useful, but not the whole world. The practical lesson for anyone managing cloud systems: AI can handle the tedious repair work, but something must independently verify the fix before it goes live.