A new scanner can catch AI coding assistants that have been secretly trained to slip security bugs into their output, without needing access to the model's internals.
The tool, called CodeScan, is a black-box auditing framework built for code-generation LLMs that attackers have backdoored or poisoned to write insecure code on cue. It works by feeding a model many different clean prompts, then comparing the structure of what comes back using abstract syntax tree normalization, so that different-looking but semantically identical code gets grouped as the same pattern. When a structure keeps recurring across generations, an LLM-based check inspects it for known vulnerability types, and if it finds one, the model gets flagged as compromised. The researchers tested CodeScan against four attack methods, covering both backdoor and poisoning styles, across three vulnerability classes, running it on 117 models spanning three architectures and multiple sizes. They reported detection accuracy above 97%, with far fewer false positives than prior methods.
This matters because software teams are leaning harder on AI-generated code, and a poisoned model could quietly plant the same exploitable bug across thousands of codebases before anyone notices. Older detection methods look at token-level consistency in generated text, which falls apart for source code, since the same vulnerability can be written a dozen syntactically different ways. Normalizing at the AST level instead of the token level is the actual novel move here.
It's still a lab result, not a shipped product. And it requires the defender to already know which vulnerability classes to hunt for, so it won't catch a poisoning attack nobody thought to look for.