News for hackers. Stuff that matters.

Ask HN: Which AI Security tool do you use and why for your repositories?

Hello World!

So I am new to the world of cybersecurity, and after some back and forth with AI, I chose to use a specific tool that was recommended for automated vulnerability detection & patching, but I think the issue I encountered is something common to all similar platforms that provide AI security fixes in 2026.

It proposed a fix to an issue labeled 'critical'. I gave the specific file and the fix to Gemini, and, it disagreed strongly.

My trust in the platform immediately degraded.

It shows in my thinking that AI security platforms for repositories are unreliable, unless you cross check every critical/high vulnerability as a human with another AI tool as well. For example, for another issue labeled 'High', the fix, I cross-checked, was correct in that case.

But that that one 'critical' issue, which turned out to be not a bug at all, and certainly not critical at all, has degraded my trust strongly in AI security platforms for automated vulnerability detection & patching. Note, to prevent confusion, with automated patching I mean automated pull requests with AI-proposed fixes, pending explicit human merging.

Now, I wonder what you guys use (instead, if at all), and how reliable your security tool(s) are, if at all, for automated vulnerability detection (& patching.)

Happy Coding!

Worldwide Wishes,

Behan

( 3 comments | 2 points | on HN )
Re:Ask HN: Which AI Security tool do you use and why for you... by J4v-Cyberpunkco on Thursday October 22, 2026 @01:38PM (#50198585)
I recommend to not use AI for any automated tasks. They are great for reasoning, but the AI Agent hype will fail. If you are interested, check my open-source research on AI capability https://cyberdeck-ai-knowledge-system.org/ which includes a secure set up for Linux networks and single Linux machines: https://cyberdeck-ai-knowledge-system.org/posts/diamondice/

However, you can use an LLM to understand log files and tool output and most certainly to find a secure system architecture.

Re:Ask HN: Which AI Security tool do you use and why for you... by penthera on Thursday November 05, 2026 @05:55AM (#50377678)
Hey Behan! agreed with @J4v-Cyberpunkco giving your fullcode base to an LLM provider might not be the most secure move. AI is great for action oriented fixing; but in my experience (pentester) not verifiable AI found "everything" (how could you know what happens in their reasoning/process?)

So I've always used my local rule-based checking systems (acts like a white/red-hat hacker on your codebase) and it flags out most vulnerabilities; not bulletproof - working on that. Made it open-source if you'd like to use it: https://github.com/danoszz/penthera - you can use it through your CLI or Cursor, Claude Code as MCP/skill/agent or via NPM: https://www.npmjs.com/package/penthera - we even have a 24/7 watch dashboard locally (first prototype)- read more about the project here: https://penthera.org ; I aim to make security more accessible for beginning/pro developers building their product with AI tools.

Our rules are research backed and score #1 on a few benchmarks, for now, I am sure paid tools (Snyk, Aikido, Wiz) have a much larger database and more advanced models; but for now rule-based (non-AI) is my bet for the future; we deeply need to understand how these models operate by opening up the engine and have these transparent rules. Let me know if this solves your challenge! its free ofc :)

Daan

happy (safe) coding

Re:Ask HN: Which AI Security tool do you use and why for you... by danosz on Thursday November 05, 2026 @08:41AM (#50378945)
hey Behan! agreed with Cyberpunkco giving your fullcode base to an LLM provider might not be the most secure move. AI is great for action oriented fixing; but in my experience (pentester) not verifiable AI found "everything" (how could you know what happens in their reasoning/process?) So I've always used my local rule-based checking systems (acts like a white/red-hat hacker on your codebase) and it flags out most vulnerabilities; not bulletproof - working on that. Made it open-source if you'd like to use it: https://github.com/danoszz/penthera - you can use it through your CLI or Cursor, Claude Code as MCP/skill/agent or via NPM: https://www.npmjs.com/package/penthera - we even have a 24/7 watch dashboard locally (first prototype)- read more about the project here: https://penthera.org ; I aim to make security more accessible for beginning/pro developers building their product with AI tools. Our rules are research backed and score #1 on a few benchmarks, for now, I am sure paid tools (Snyk, Aikido, Wiz) have a much larger database and more advanced models; but for now rule-based (non-AI) is my bet for the future; we deeply need to understand how these models operate by opening up the engine and have these transparent rules. Let me know if this solves your challenge! its free ofc :)

Daan happy (safe) coding