Patch Me If You Can: AI Codemods for Secure-by-Default Android Apps

Read the full articlePatch Me If You Can: AI Codemods for Secure-by-Default Android Apps on Meta Engineering

What Happened

Even seemingly simple engineering tasks — like updating an API — can become monumental undertakings when you’re dealing with millions of lines of code and thousands of engineers, especially if the changes are security-related. Nowhere is this more apparent than in mobile security, where a single cla

Our Take

honestly? when you're dealing with millions of lines of code and thousands of engineers, manual security patching is a nightmare. ai codemods for security aren't some theoretical concept; they're about automating the identification and application of complex security fixes across massive codebases.

the challenge isn't just writing the patch; it's ensuring the change is secure and doesn't introduce new bugs across a sprawling codebase. this is where the risk comes in—one wrong ai-generated change can brick the entire deployment pipeline.

we're talking about moving from human-intensive review to machine-assisted review, which is necessary if we want to keep up with the pace of mobile security threats. it's messy, but the potential for reducing critical vulnerabilities is there.

What To Do

Pilot AI-assisted code modification tools for automated security patching in large mobile projects.

Builder's Brief

Who

Android platform engineers and mobile security teams managing large codebases

What changes

automated AI-driven security patching becomes a viable pipeline stage, reducing manual migration cost

When

months

Watch for

Google adopting this approach internally for AOSP security updates

What Skeptics Say

AI codemods at scale still require heavy human validation for security-critical changes; automating patches across millions of lines introduces regression risk that point benchmarks systematically undercount.

Cited By

Meta Engineering Patch Me If You Can: AI Codemods for Secure-by-Default Android Apps