I'm curious to hear people's thoughts on this. It's an idea I've been playing with in my head for a while, but most of it falls way outside my expertise.

There are definitely a lot of challenges with it, mainly false positives (e.g. maybe a double nested for-loop with a dozen conditionals looks like a vulnerable AST, but it's in a non-critical portion of code). But I think the central idea of training ML algorithms based on existing vulnerabilities would lead to a very efficient way of finding NEW vulnerabilities. At the very least, it could provide an efficiency boost to tools like fuzzers, by directing them to the critical portions of code. Also, it does not necessarily have to work on only open source code. It could also disassemble the vulnerable binary and the patched binary, and compare their ASM instructions. In fact this might even lead to higher signal than the AST method.