Sutter Health’s Matt Seul walks through the cost and reliability problems he hit building an AI agent that scans code for security flaws. Watch below or on YouTube.
Turning an AI model’s reasoning all the way up can raise an agent’s token bill and make its output less predictable, Matt Seul found while building a tool that scans code for security flaws. On a recent episode of the healthsystemCIO Show, the Principal Information Security Architect at Sutter Health said his first version produced results in about half an hour. Getting it to run consistently, with generally stable output that would feed into Sutter’s systems, took about three months. Seul, who stressed that he was offering his own views and not speaking for Sutter, traced that gap to technical problems he encountered in the models and the software around them.
The tool grew out of Sutter’s effort to modernize its software security stack. Existing scanning tools kept leaving blind spots, such as missing support for less common programming languages, Seul said. The agent also sits on top of Sutter’s classic security tooling and does not replace it. Along the way, he catalogued four failure modes that he believes apply regardless of the model or the harness, the software that connects a model to tools and data. They form the basis of “The Four Horsemen of the AIpocalypse,” his talk at the Health-ISAC Fall Americas Summit, Nov. 30–Dec. 4 in Tucson, Ariz. In the interview, he walked through three of them.
Source link







