Tree of AST: A Bug-Hunting Framework Powered by LLMs

Transcript of a Dark Reading News Desk interview (Black Hat USA 2025) with Sasha Zyuzin and Ruikai Peng describing their "Thinking Outside the Sink: How Tree of AST Redefines the Boundaries of Data Flow Analysis" framework, which integrates static analysis and Google DeepMind's Tree of Thoughts to automate repetitive vulnerability discovery tasks while retaining human-in-the-loop verification to avoid false positives; the interview also discusses AI-driven coding risks ("vibe coding"), how their approach complements existing tools, and the recommendation to delegate strategic thinking to LLMs while keeping deterministic programs for manual validation.