Uploaded December 2025 | Updated September 2026, 1 week ago
At OWASP SF 2024, I spoke about the dangers of trusting AI to automatically fix code vulnerabilities. Since then, our team has spent many months trying to prove I was right—and may have proven the opposite. In this session, I'll share the results of our research into using LLMs to generate secure auto-fixes and detect false positives and the tooling we developed to do it safely and at scale.
We built a system that combines curated remediation guidance, real-world vulnerable code, and test-driven prompt engineering to produce accurate, verifiable fixes. The same process also generates prompts for identifying false positives—making it possible to validate whether an issue is real and how to fix it. This effort taught us how to guide AI toward delivering high-quality fixes while also showing when to fall back to deterministic logic. Using this approach, a small team can generate 80–120 validated fix rules per month and ramp up support for new languages in weeks instead of months.
This talk is not a product pitch—it's a blueprint. If you have the time and resources, you can build something similar. We'll share the patterns, mistakes, and lessons that shaped the process and the limitations this approach still wrestles with. We'll invite the audience to put it to the test in an interactive review of code fixes that seem secure but aren't.
Eitan Worcel
Mobb
Co-Founder and CEO
USA
twitter.com/EWorcel
linkedin.com/in/worcel
Eitan Worcel is the co-founder and CEO of Mobb, the recent Black Hat StartUp Spotlight winner. He is an application security expert with more than 15 years of experience as a developer, product management leader, and now business leader. Throughout his career, Eitan has worked with numerous companies to help them detect security issues and is now on a mission to help make those findings actionable with trusted automated vulnerability remediation.
In the past, in his spare time, Eitan used to be a long-distance runner and participated in a few marathons, including the Red Rock Canyon Marathon, and even did an ultra marathon. Now, since starting Mobb, he simply doesn't have spare time...
Managed by the OWASP® Foundation
owasp.org
At OWASP SF 2024, I spoke about the dangers of trusting AI to automatically fix code vulnerabilities. Since then, our team has spent many months trying to prove I was right—and may have proven the opposite. In this session, I'll share the results of our research into using LLMs to generate secure auto-fixes and detect false positives and the tooling we developed to do it safely and at scale.
We built a system that combines curated remediation guidance, real-world vulnerable code, and test-driven prompt engineering to produce accurate, verifiable fixes. The same process also generates prompts for identifying false positives—making it possible to validate whether an issue is real and how to fix it. This effort taught us how to guide AI toward delivering high-quality fixes while also showing when to fall back to deterministic logic. Using this approach, a small team can generate 80–120 validated fix rules per month and ramp up support for new languages in weeks instead of months.
This talk is not a product pitch—it's a blueprint. If you have the time and resources, you can build something similar. We'll share the patterns, mistakes, and lessons that shaped the process and the limitations this approach still wrestles with. We'll invite the audience to put it to the test in an interactive review of code fixes that seem secure but aren't.
Eitan Worcel
Mobb
Co-Founder and CEO
USA
twitter.com/EWorcel
linkedin.com/in/worcel
Eitan Worcel is the co-founder and CEO of Mobb, the recent Black Hat StartUp Spotlight winner. He is an application security expert with more than 15 years of experience as a developer, product management leader, and now business leader. Throughout his career, Eitan has worked with numerous companies to help them detect security issues and is now on a mission to help make those findings actionable with trusted automated vulnerability remediation.
In the past, in his spare time, Eitan used to be a long-distance runner and participated in a few marathons, including the Red Rock Canyon Marathon, and even did an ultra marathon. Now, since starting Mobb, he simply doesn't have spare time...
Managed by the OWASP® Foundation
owasp.org
