Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
GPT-3 found hundreds of security vulnerabilities in this repo - (this was the first real LLM cybersecurity eval!)
| Date | Stars |
|---|---|
| 2026-07-31 | 602 |
| 2026-08-03 | 602 |
| 2026-08-06 | 602 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
0.0
growth rate 0.00%/day
# Experimenting with GPT-3 for Detecting Security Vulnerabilities in Code (this was the first real LLM cybersecurity eval!)
**Summary**: GPT-3 found 213 security vulnerabilities in this [git repository](https://github.com/chris-koch-penn/gpt3_security_vulnerability_scanner). In comparison, one of the better commercial tools on the market (from a reputable cybersecurity company) only found 99 issues, although their tool provides context in a more structured format. After manually reviewing a random sample of 60 / 213 of the vulnerabilities detected by GPT-3, only 4 were false positives. Both tools had many false negatives.
The full text of this README is available as a Medium article [here](https://betterprogramming.pub/i-used-gpt-3-to-find-213-security-vulnerabilities-in-a-single-codebase-cc3870ba9411).
## Introduction
In recent years, the field of artificial intelligence and machine learning has seen tremendous growth and has opened up a new realm of possibilities. One such field that has been gaining attention is AI-based code analysis, specifically the use of AI models to detect security vulnerabilities in code. In this experiment, we used OpenAI's GPT-3 to find security vulnerabilities in a [code repository](https://github.com/chris-koch-penn/gpt3_security_vulnerability_scanner) containing 129 vulnerable files.
## How it Works
The variant of GPT-3 I used (text-davinci-003) has a context window of 4000 tokens, which is roughly 3000 english words. This means it can process at most a few hundred lines of code per request. Unfortunately, GPT-3’s current architecture can’t handle a whole repo at once.
To get around this, I had to scan all of the files with GPT-3 separately. This means GPT-3 might have trouble finding security vulnerabilities that are the result of multiple files of code interacting, unless the import/exports are clear enough to make a guess as to what those functions do without needing to specifically see the code. This ended up often being the case, particularly when the source code was using common libraries like express.js, Flask, the Python standard library, the C standard library, etc. It’s likely that GPT-3 has many of the most common libraries either partially memorized, fully memorized, or encoded in some other way. In the case of the code analyzed in this article, GPT-3 had enough prior knowledge about the imported libraries that it was able to accurately detect security vulnerabilities without needing to inspect any of the imported library code.
To be fair to GPT-3, I suspect that many of the existing commercial vulnerability scanners don’t actually inspect imported library code when doing static analysis — so this is not that different from how some of the tools on the market already work.
### The code that was analyzed
Each folder in the repository is named after a type of security vulnerability and contains files with example code containing one or more vulnerabilities. Some of these files contain trivial code, but many are fairly realistic code snippets you might come across in a production code base (note: they are still snippets though, and therefore lack the context of a larger codebase). The README.md file in each folder of the repository contains GPT-3’s analysis of the security vulnerabilities for all of the files in that folder.
Let’s take a look at some examples to see how GPT-3 did!
### Example 1 (trivial)
Here is a [simple C program](https://github.com/chris-koch-penn/gpt3_security_vulnerability_scanner/blob/main/Format%20String%20Attacks/FormatString.c) that is vulnerable to a Format String Attack:
```c
#include <stdio.h>
int main(int argc, char **argv) {
printf(argv[1]);
return 0;
}
```
And here is GPT-3's analyis (which is correct):
```md
Vulnerabilities Detected:
1. Unvalidated user input: The program does not check the length of the user input, which could lead to a buffer overflow attack.
2. Format string vulnerability: The program does not check the format of Excerpt of 15,359 characters
Read on GitHub
8
Would you bet a product on this? Bounded 0–100 and slow moving.
matched fp:4e83d83541d7b99b, llm:Description: 'GPT-3 found hundreds of security vulnerabilities in this repo - (this was the first real LLM cybersecurity eval!)' Language: PHP. No topics.
matched fp:4e83d83541d7b99b, llm:Description: 'GPT-3 found hundreds of security vulnerabilities in this repo - (this was the first real LLM cybersecurity eval!)' Language: PHP. No topics.