Security quotes of the week

I'm... pretty cautious about Google's AI bug fixer. AI's are already notorious for false confidence; claiming to fix things that they haven't. I'm sure that they have a system design which will run test cases against the bug, and that they based their 15% on those cases; but if no human ever actually understands the bug, how can we be sure that the fix isn't just papering over a deeper problem? A bug involving a null pointer dereference might be fixed by a null check, but if the pointer shouldn't be null, it might be used again.