Detecting malicious pull requests at scale with LLMs | Datadog

This post details the evolution of Datadog's malicious code detection system, BewAIre, which now reviews all pull requests in real-time using LLMs. It describes the challenges of increased PR volume due to AI-assisted development, the limitations of traditional static analysis tools, and the system's architecture for ingestion, preprocessing, and inference. Key technical details include the use of prompt engineering and data tuning for accuracy, strategies for working around LLM context window limitations, and continuous testing against real-world exploits. The system achieved >99.3% accuracy with a 0.03% false positive rate on a curated dataset and demonstrated 100% detection of known malicious package compromises. The post also highlights the importance of building a custom dataset of malicious and benign PRs, as no ready-made repository exists.