BewAIre: Detecting Malicious Pull Requests at Scale with AI

Attackers create malicious pull requests to exploit routine development workflows to exfiltrate secrets, compromise public packages, and gain access to production systems. Autonomous hackbots and rogue agents are enabling more sophisticated attacks. At the same time, AI coding agents are accelerating software development, increasing the number and size of pull requests. Together, these challenge human reviewers. Datadog built BewAIre, an AI-powered code review system, to protect against malicious PRs without slowing down development velocity.

In this breakout session, Christoph Hamsen, Staff Security Engineer, will share how BewAIre was built for code threat detection. He will trace the engineering journey from single-pass evaluations to an agentic system with additional tools and context. Along the way, he will examine key architectural decisions, benchmarking approaches, and the practical challenges of improving and operating AI systems at scale.

He will also cover BewAIre's integration into the Datadog Code Security product. Attendees will leave with practical lessons on building, hardening, and productizing LLM-powered systems to tackle modern development challenges.