hollowtest flags meaningless AI-generated tests that boost coverage but prove nothing

·2 views

A developer has released hollowtest, an open-source Python tool designed to detect test functions that pass without actually verifying any meaningful behavior. The tool statically analyzes test files using Python's AST, flagging patterns such as missing assertions, tautologies like 'assert True', and mock-only checks that never validate real outcomes. It supports pytest and unittest conventions and requires no external dependencies, running entirely on the Python standard library. The project was motivated by the rise of AI-generated code, where tools often produce tests that inflate coverage metrics without catching bugs. hollowtest integrates with CI pipelines and GitHub Actions, exiting with configurable error or warning codes, and is available under the MIT license for Python 3.10 and above.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

OWASP Cornucopia v3.4 Released with Expanded AI Threat Mapping Support

OWASP has released Cornucopia version 3.4, a security-focused card game used for threat modelling in software development. The update broadens threat identification coverage to include both traditional web applications and modern AI architectures. The release also introduces EoP (Elevation of Privilege) help pages and a new component referred to as PHANTOM-B. The update was authored by Johan Sydseter for the OWASP Foundation and announced on July 21.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Fixes Local AI Degradation by Replacing Chat Logs with Distilled Facts

A developer running a personal AI assistant on a local Qwen3-4B-4bit model via Swama found that performance degraded significantly after 196 accumulated messages, with the model repeating itself and over-relying on stale context. The root cause was a memory layer that replayed raw conversation history into the prompt, a method that worked with hosted models but overwhelmed the smaller local one. The fix involved splitting memory into two distinct layers: short-term conversation state stored in RAM with an idle timeout and hard message cap, and long-term memory capped at 30 distilled personal facts per user. Fact extraction runs in a background thread using a hosted model to ensure quality without slowing down responses. The developer concluded that raw transcript replay is one of the easiest ways to degrade a personal assistant, and that minimal, structured memory outperforms large context dumps for small local models.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

RedHook Android malware exploits Wireless Debugging to silently capture screens

Security firm Group-IB published an analysis on July 9 revealing a new variant of the Android trojan RedHook that gains shell-level privileges without rooting, exploiting or connecting to a PC. The malware spreads through phishing calls or messages impersonating banks or government agencies, directing victims to sideload an APK from a fake Play Store site. Once installed, it manipulates the device's Accessibility Service to silently enable Developer Options and Wireless Debugging, then connects to the phone's own ADB daemon over loopback to escalate privileges. From this position, it can stream the victim's screen via RTMP, bypassing Android's mandatory MediaProjection consent dialog entirely, while also executing 53 server-issued commands including silent app installs and keystroke logging. Active campaigns have been observed targeting users in Vietnam and Indonesia, though the technique is not geographically limited.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds structured AI paraphrasing pipeline to prevent meaning drift

A developer building a tool called Paraphraser AI identified a core challenge with large language models: they produce fluent text but can silently alter facts, drop qualifiers, or change numbers during rewriting. To address this, the pipeline treats each rewrite request as structured data with separate fields for mode, strength, protected keywords, and output count, rather than a single open-ended prompt. Each rewrite mode and strength level is translated into a concrete instruction to improve model consistency and prevent vague UI labels from producing unpredictable results. Input validation rules are enforced before any model call, limiting text length, capping protected keywords, and requiring SEO mode to specify at least one keyword. The author acknowledges the pipeline reduces common failure modes but stops short of claiming it can fully guarantee semantic faithfulness in all cases.

0 comments Read more at DEV Community