DETECTING MALICIOUS PULL REQUESTS AT SCALE WITH LLMS

Summary from the TLDR InfoSec newsletter

Datadog's BewAIre is an LLM-powered system that reviews every pull request for malicious intent. Achieving over 99.3% accuracy and a 0.03% false positive rate after six months of tuning, the system addresses limitations of traditional static analysis by detecting intent-based attacks, such as credential exfiltration and obfuscated payloads, and by using recursive diff chunking to handle large PRs that attackers exploit to hide malicious code. Security teams can apply similar approaches by combining curated malicious datasets, prompt engineering with pattern exclusions, and adversarial red-teaming to build LLM-based detection that complements existing SAST/SCA tooling.