CodeTracer: Forensic Tool for AI Code Backdoors

A new forensic tool called CodeTracer helps identify poisoned code in AI assistants. Here's the thing: developers often accept AI code suggestions quickly, but some AI models can be trained on tampered code. This means a flaw can sit undetected until a specific prompt triggers insecure code. Most defenses try to catch this early, but CodeTracer works *after* a harmful completion has already been produced. Its job is to trace that bad code back to the original training examples that taught the behavior. This is like a root-cause analysis for machine learning supply chains. CodeTracer works in three stages. First, it summarizes the unsafe behavior. Second, it searches training data for similar code. Third, it uses a language model, like GPT-4.1, to confirm if a candidate training example contains the same unsafe pattern. The tool was tested on over a million Python files from GitHub, focusing on unsafe patterns found in production software. This matters because it helps secure the software supply chain against hidden vulnerabilities.